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Agilent Technologies E5900B Option 300 
Emulation Probe—At a Glance 


This manual describes how to set up several emulation products: an emulation 
probe, an emulation module, and an emulation migration. 


The emulation probe provides a low-cost way to debug embedded software for 
ARM7/ARM9 family microprocessors. The emulation probe lets you use the 
target processor’s built-in JTAG debug port features, including: run control, 
register access, and memory access. A high-level source debugger can use the 
emulation probe to debug code running on the target system. 


The emulation probe can be controlled by a debugger on a host computer or 
by the Emulation Control Interface on an Agilent 16700-series logic analysis 
system. 


E5900B Emulation Probe 


The emulation probe communicates with a host computer or logic analysis 
system via LAN. 


Host 
Computer 


Target System 
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E5901B Emulation Module 


The Agilent E5901B emulation module plugs into your Agilent 16700-series 
logic analysis system frame. It provides power, cross triggering, and limited 
communication for the E5900B emulation probe through the module/probe 
interconnect cable. The logic analysis system communicates with the target 
system through the LAN connection to the E5900B emulation probe. 


’ Logic Analysis 
System 


>|___—  E5901B Emulation Module 


Module/Probe Interconnect Cable 


LAN Cable 


E5900B Emulation Probe 


65902001 


-—~ Target System 


The E5901B emulation module must be used with an E5900B emulation probe. 


This is a major change from the E5901A (16610A) emulation module, which could 
be connected directly to a target system through a target interface module 
(TIM). 


E5902B Emulation Migration 

The emulation migration includes the parts needed to use an emulation probe 
for a new processor family. 

Emulation Solution 


If you have an E9xxxB emulation solution, refer to the Solutzon User’s Guide 
for information on how to connect the analysis probe, then return to this book 
for information on connecting the emulation probe. 
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In This Book 


In This Book 


This book documents the following products: 


Emulation Probe 


Product ordered 


Includes 


Agilent E5900B Option #300 


Agilent Technologies E5900B emulation 
probe, cables, software, and manual 


Emulation Module 


Product ordered 


Includes 


Agilent E5901B Option #300 


Agilent Technologies E5901B emulation 
module, E5900B Option #300 emulation 
probe, cables, software, and manual 


Emulation Migration 


Product ordered 


Includes 


Agilent E5902B Option #300 


Target board adapter, front panel, tool kit, 
cables, software, and manual 


Emulation Solution 


Product ordered 


Includes 


Agilent E9495B Option #001 


E5901B emulation module, E5900B #300 
emulation probe, cables, software, and 
manual, plus analysis software as 
described in the Solution User's Guide 
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Processors Supported 


The following processors are supported by the Agilent products listed on the 
previous page: 


Processors Supported 


ARM7TDMI 
ARM7DI 
ARM710T 
ARM720T 
ARMSTDMI 
ARM740T 
ARM 920T 
ARM 922T 
ARM 925T 
ARM 940T 
ARM 946ES 
ARM 966ES 
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Overview 


Overview 


This chapter describes: 


e Setup flowchart 

e Equipment used with the emulation probe 

e Connection sequences for the emulation probe 
e Equipment used with the emulation module 


e Additional information sources 
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Setup Flowchart 
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Agilent E5900B Emulation Probe 


Equipment supplied 

e Emulation probe. 

e 12V power supply for the emulation probe. 

e Power cord. 

e Ferrite (reduces electromagnetic interference on power cord). 
e 


Serial cable and RJ12-to-DB9 adapter (for setting the emulation probe’s IP 
address from a PC). 

14-pin cable. 

20-pin low density cable. 

20-pin high density cable. 

ARM TI/VLSI/20-pin high density cable adapter board. 

ARM 14-pin cable adapter board. 


This User’s Guide. 


Minimum equipment required 


The following equipment is required to use the emulation probe: 


A method for connecting the emulation probe to the target system. The 
target system must have an appropriate JTAG debug port connector. The 
target system must meet the criteria on page 56. 

A host computer, such as a PC or workstation. You can also connect the 
emulation probe to an Agilent 16700-series logic analysis system. 

A LAN (local area network) to connect the emulation probe to the host 
computer or logic analysis system. 

A user interface on the host computer, such as a high-level source 
debugger or the logic analysis system’s Emulation Control Interface. 


Agilent Technologies E5900B Emulation for ARM 


Overview 
Agilent E5900B Emulation Probe 


20-pin low 
rae 20-pin high Cable Adapter Boards 


Agilent Technologies E5900B Emulation for ARM 19 
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Agilent E5900B Emulation Probe 


To connect the emulation probe to a power source 


The emulation probe is shipped from the factory with a power supply and cord 
appropriate for your country. If the cord you received is not appropriate for 
your electrical power outlet type, contact your Agilent Technologies sales and 
service office. 


WARNING: f Use only the supplied Agilent F1044B power supply and cord. Failure to use 
the proper power supply could result in electric shock. 


CAUTION: Use only the supplied Agilent power supply and cord. Failure to use the 
proper power supply could result in equipment damage. 


1 Install the ferrite on the 12V power cord, near the end which plugs into 
the emulation probe. 


2 Connect the power cord to the power supply and to a socket outlet. 


oT 


3 Connect the 12V power cord to the back of the emulation probe. 


Ferrite 


4 Turn on the emulation probe power switch. 
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Connection Sequence 


Disconnect power from the target system, emulation probe, and logic analyzer 
before you make or break connections. 


1 Connect the emulation probe to a LAN (page 27). 
2 Connect the emulation probe to your target system (page 65). 


3 Configure the emulation probe (page 71). 


To power on the system 

With all components connected, power on your system as follows: 
1 Logic analyzer, if you are using one. 
2 Emulation probe. 


3 Your target system. 


To power off the system 
Power off your system as follows: 
1 Your target system. 
2 Emulation probe. 


3 Logic analyzer, if you are using one. 
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Agilent E5901B Emulation Module 


Equipment supplied 


The equipment supplied with your emulation module includes: 


All of the parts listed for the Agilent E5900B emulation probe on 
page 18 (except the serial cable and RJ12 to DB9 adapter). 


Agilent E5901B emulation module. If you ordered an emulation module as 
part of your Agilent 16700-series logic analysis system, it is already 
installed in the frame. 


Module/probe interconnect cable (connected to the emulation module). 


Software for the Emulation Control Interface and firmware for the 
emulation probe on a single CD-ROM. 


Torx T-10 and T-15 screwdrivers. 


Minimum equipment required 


The following equipment is required to use the emulation module: 


A method for connecting the emulation probe to the target system. The 
target system must have an appropriate JTAG debug port connector. The 
target system must meet the criteria on page 56. 

An Agilent 16700-series logic analysis system. 

A user interface, such as a high-level source debugger or the logic analysis 
system’s Emulation Control Interface. 
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Agilent E5902B Emulation Migration 


Equipment supplied 


The equipment supplied with your emulation migration includes: 


A emulation probe personality board (target board adapter) for the 
E5900B emulation probe. 

Firmware for the emulation probe and updated software for the Emulation 
Control Interface on a CD-ROM (use if you have a 16700-series logic 
analysis system). 

Firmware for the emulation probe on floppy disks (use if you do not have a 
logic analysis system). 

14-pin cable. 

20-pin low density cable. 

20-pin high density cable. 

ARM TI/VLSI/20-pin high density cable adapter board. 

ARM 14-pin cable adapter board. 

Front panel for the emulation probe. 

Tool kit including a 1/4 inch wrench, a #1 Phillips screw driver, and a Torx 
T-10 screwdriver. 

This User’s Guide Update. 

An Emulation User’s Guide for your processor. 


Minimum equipment required 


The following equipment is required to use the emulation migration: 


An Agilent E5900B emulation probe. 

A method for connecting the emulation probe to the target system. The 
target system must have an appropriate JTAG debug port connector. The 
target system must meet the criteria on page 56. 

A host computer such as a PC, a workstation, or an Agilent 16700-series 
logic analysis system. 

A user interface, such as a high-level source debugger or the logic analysis 
system's Emulation Control Interface. 
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E9495B Emulation Solution 


If you ordered an emulation solution, the manual supplied with your inverse 
assembler will provide additional information. 


Additional Information Sources 


Additional or updated information can be found in the following places: 


Newer editions of this manual may be available. Contact your local Agilent 
Technologies representative. 


If you have an analysis probe, the instructions for connecting the probe to 
your target microprocessor are in the analysis probe documentation. The 
Solutions User’s Guide for your microprocessor provides information on 
using the analysis probe and emulation module together. 


Application notes may be available from your local Agilent representative or 
on the World Wide Web at: 


http://www. agilent.com/find/logicanalyzer 


If you have an Agilent 16700-series logic analysis system, the online help for 
the Emulation Control Interface has additional information on using the 
emulation probe. 


The measurement examples include valuable tips for making emulation and 
analysis measurements. You can find the measurement examples under the 
system help in your Agilent 16700-series logic analysis system. 
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Connecting the Emulation Probe 
to a LAN 


See Also 


Connecting the Emulation Probe to a LAN 


You need to set up a LAN connection for the E5900B emulation probe, even if 
you are using an E5901B emulation module. 


The emulation probe has an IEEE 802.3 Type 10/100Base-TX LAN connector. 


The emulation probe is compatible with both 10 Mbps (1LOBASE-T) and 100 
Mbps (100BASE-TX) twisted-pair ethernet LANs. The probe automatically 
negotiates the data rate for the LAN it is connected to. 


Before the Emulation Control Interface can connect to the emulation probe, 
the probe’s LAN parameters (that is, its IP address, gateway address, and 
subnet mask) must be set up. The IP address and other network parameters 
are stored in nonvolatile memory within the emulation probe. 


For information on connecting a debugger to the emulation probe, see 
Chapter 9, “Using the Emulation Probe with a Debugger,” beginning on page 
105. 


To choose a point-to-point or site LAN connection 


You can connect the emulation probe to your site LAN, or you can create an 
isolated network between a 16700-series logic analysis system and the 
emulation probe using a point-to-point connection. 


A point-to-point connection is especially useful when you 
have a 16700-series logic analysis system, and: 


e You do not have a site LAN, or 

e The measurement setup will be on a cart, or 

e You do not want to connect the measurement setup to a LAN because of 
security reasons. 


Advantages of a point-to-point connection: 


e Ifyou have an E5901B emulation module, all LAN parameters will be set 
automatically. 
e No need for a system administrator to assign IP addresses. (You can use 
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any IP address for the emulation probe, and it will not conflict with other 
devices on the LAN.) 

The logic analysis system cannot be accessed across the network (required 
in some high-security environments). 

Can be used when a site LAN is not available. 


Disadvantages of a point-to-point connection: 


Neither logic analysis system nor the emulation probe are connected to a 
site LAN. 
A special "crossover" LAN cable must be used. 


If you have an emulation module, use the LAN crossover cable supplied 
with the emulation module (Agilent part number 5061-7341). If you do not 
have an emulation module, use a Category 3 (for 1OBASE-T) or Category 5 
(for L1OOBASE-TX) crossover cable. 


The emulation probe must be near the logic analysis system. The length of 
the crossover cable supplied with emulation modules is 1.5m (5 feet). 
Remote file systems cannot be mounted for access to source code files, 
symbol files, or executable files. 

The emulation probe cannot be controlled by a debugger on a host 
computer. 


Connection Method Go to Page 
Site LAN connection page 30 
Point-to-point page 38 
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Connecting the Emulation Probe to a Site LAN 


1 Connect the LAN cable to the connector on the emulation probe. 


Be sure to use the appropriate Category 3 or Category 5 cable for your LAN. 
Do not use the LAN cable supplied with the emulation probe—it is a crossover 
cable used for point-to-point connections only. 


2 Find out the IP address and other LAN parameters to use for the 
emulation probe. See “To obtain an IP address” on page 31. 


3 Decide how you want to configure the LAN parameters: 


If you have this equipment... Use this procedure 


Emulation probe only “To configure LAN parameters using a serial 
connection” on page 32, or 
“To configure LAN parameters using DHCP” 


on page 35 
Emulation probe and a logic “To configure LAN parameters using a logic 
analysis system without an analysis system without an emulation module” 
E5901B emulation module on page 36 
Emulation probe and a logic “To configure LAN parameters using a logic 
analysis system with an E5901B — analysis system with an emulation module” on 
emulation module page 37 


4 Verify that your emulation probe is now active and on the network. See 
"To verify LAN communications" on page 40. 
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To obtain an IP address 


1 Obtain the following information from your local network administrator 
or system administrator: 


e An IP address for the emulation probe. 


You can also use a "LAN name" for the emulation probe, but you must 
configure it using the integer dot notation (such as 127.0.0.1). 


e The gateway address. 


The gateway address is an IP address and is entered in integer dot 
notation. The default gateway address is 0.0.0.0, which allows connections 
only on the local network or subnet. If connections are to be made to 
workstations on other networks or subnets, this address must be set to the 
address of the gateway machine. 


e The subnet mask. 


A subnet mask blocks out part of an IP address so that the networking 
software can determine whether the destination host is on a local or 
remote network. It is usually represented as decimal numbers separated 
by periods; for example, 255.255.248.0. 


2 Find out whether port numbers 6470 and 6471 are already in use on 
your network and if that use constitutes a conflict. 


The host computer interfaces communicate with the emulation probe through 
two TCP service ports. The default base port number is 6470. The second port 
has the next higher number (default 6471). 


In almost all cases, the default numbers (6470, 6471) can be used without 
change. If necessary the base port number can be changed if the port numbers 
conflict with some other product on your network. 


To change the port numbers, see page 34. If you have already set the IP 
address, you can use a telnet connection instead of a serial connection to 
connect to the emulation probe. 
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To configure LAN parameters using a serial connection 


The E5900B emulation probe has a 9600 baud RS-232 serial interface with an 
RJ12 connector. 


The emulation probe is shipped with a serial cable (with RJ-12 connectors on 
both ends, with 6-wire straight-through connections) and an adapter (female 
RJ-12 to female 9-pin D subminiature). The adapter plugs into the 9-pin serial 
port found on most PCs. 


Serial connections on a workstation 


If you are using a UNIX® workstation as the host computer, you need to use a 
serial device file. If a serial device file does not already exist on your host, you 
need to create one. Once it exists, you need to ensure that it has the 
appropriate permissions so that you can access it. See the system 
documentation for your workstation for help with setting up a serial device. 


Serial connections on a PC 


Serial connections are supported on PCs. You must use hardware handshaking 
if you will use the serial connection for anything other than setting LAN 
parameters. 


If you are using a PC as the host computer, you do not need to set up any 
special files. 
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1 Connect the serial cable from the host computer to the emulation 
probe. 


Use the DB9-to-RJ12 adapter and the serial cable supplied with the emulation 
probe. 


2 Start a terminal emulator program on the host computer. 


If you are using a PC, the HyperTerminal application in Microsoft Windows® 
will work fine. 


If you are using a UNIX workstation, you can use a terminal emulator such as 
cu or kermit. 


3 Configure the terminal emulator program for: 


Communication rate: 9600 baud 
Bits: 8 

Parity: none 

Stop bits: 1 

Flow control: none 


4 Turn on power to the emulation probe. 


When the emulation probe powers up, it sends a version message to the serial 
port, followed by a prompt. 


5 Press the Return or Enter key a few times. 
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-i <internet> 


-g <gateway> 


-s <subnet> 


-p <port> 


Connecting the Emulation Probe to a LAN 
Connecting the Emulation Probe to a Site LAN 


You should see a prompt such as "p>" or "R>". 


For information about the commands you can use, enter ? or help at the 
prompt. 


Display the current LAN configuration values by entering the lan 
command: 


R> lan 
lan is enabled 

Link Status is UP 

100BaseTX 

lan -i 15.5.24.116 

lan -g 15.5.23.1 

lan -s 255.255.248.0 

lan -p 6470 

Ethernet Address : 08000909BAC1 
R> 
The Ethernet address, also known as the link level address, is preassigned at 


the factory, and is printed on a label on the emulation probe. 
Enter the following command: 


lan -i <internet> [-g <gateway>] [-p <port>] [-s 
<subnet >] 


The lan command parameters are: 
The IP address which you obtained from your network administrator. 


The gateway address. Setting the gateway address allows access outside your 
local network or subnet. 


This changes the subnet mask. 


This changes the base TCP service port number, normally 6470. 


Do not change the default port numbers (6470, 6471) unless they conflict with 
some other product on your network. The numbers must be greater than 
1024. If you change the base port, enter the new value in the configuration of 
your debugger (and, for UNIX workstations, in the /etc/services file). 


Cycle power on the emulation probe. 


The IP address and any other LAN parameters you change are stored in 
nonvolatile memory and will take effect when the emulation probe is powered 
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Connecting the Emulation Probe to a LAN 
Connecting the Emulation Probe to a Site LAN 


off and back on again. 


Example 


To assign an IP address of 192.6.94.2 to the emulation probe, enter the 
following command: 


R>lan -i 192.6.94.2 


Cycle power on the emulation probe so that the new address will take 
effect. 


Verify your emulation probe is now active and on the network. See 
“Verifying LAN Communications” on page 40. 


Once you have set a valid IP address, you can use the telnet utility to connect 
to the emulation probe, and use the lan command to change LAN parameters. 


To configure LAN parameters using DHCP 


If there is a DHCP server on your network which responds to BOOTP requests 
and supports “static allocation” of IP addresses, it can be used to set the trace 
port analyzer’s LAN parameters. 


Ask your system administrator to set up an IP address for the 
emulation probe on the DHCP server. 


You will need to supply the link-level address of the emulation probe. 


The link-level address (LLA) is printed on a label above the LAN connector on 
the emulation probe. This address is configured in each emulation probe 
shipped from the factory and cannot be changed. 


Connect the LAN cable to the connector on the emulation probe. 
Cycle power on the emulation probe by powering it off then on again. 
Wait at least 20 seconds for the emulation probe to recognize the LAN. 


Verify that your emulation probe is now active and on the network. See 
"To verify LAN communications" on page 40. 
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What is DHCP? 


DHCP (Dynamic Host Configuration Protocol) allows clients to obtain LAN 
parameters automatically from a server. 


How does the emulation probe use DHCP? 


The trace port analyzer uses “static allocation” (sometimes called “manual 
allocation”) to obtain a permanent IP address. Every time the trace port 
analyzer is turned on, it sends out a BOOTP request packet. If the DHCP 
server on the network responds to BOOTP requests and has been configured 
to reply to the trace port analyzer’s link-level address, it will respond with the 
IP address and other LAN parameters. 


The trace port analyzer does not support “automatic allocation”, which 
permanently allocates IP addresses from a pool of addresses. 


Nor does the trace port analyzer support “dynamic allocation” of IP 
addresses—it does not track lease duration and request a new IP address 
when the lease is about to expire. 


How does DHCP interact with other methods of 
setting LAN parameters? 


Every time the trace port analyzer is turned ON, it sends out a BOOTP request 
packet (even if the LAN parameters have already been configured). As long as 
the DHCP server is configured to reply to BOOTP requests from the trace port 
analyzer’s link-level address, it will respond with the IP address and other LAN 
parameters. 


To configure LAN parameters using a logic analysis 
system without an emulation module 


Connect the LAN cable to the connector on the emulation probe. 
In the logic analysis system interface, open the Workspace window. 
Drag the emulation probe tool from the toolbox to the workspace. 


From the emulation probe icon, select Init Probe LAN Addresses... 
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Enter the link-level address of the probe you wish to set up. 


Enter the internet address, gateway IP and subnet mask in the 
appropriate fields. 


Select OK. 


If "ERROR - no response from emulation probe" is displayed, check that the 
emulation probe is properly connected to the LAN. Then try selecting 0K 
again. 


If no error message is displayed, the internet address and other network 
parameters will be stored in nonvolatile memory and will take effect when 
power is cycled. 


Cycle power on the emulation probe by powering it off then on again. 


To configure LAN parameters using a logic analysis 
system with an emulation module 


Connect the emulation module to the emulation probe. (See page 47.) 
Connect the LAN cable to the connector on the emulation probe. 
Cycle power on the emulation probe by powering it off then on again. 
Wait at least 20 seconds for the emulation probe to recognize the LAN. 


From the E5901B emulation module icon, select Modify Interconnected Probe 
LAN Addresses... 


6 Select Read Probe Addresses to read the current settings. 


Enter the internet address, gateway IP and subnet mask in the 
appropriate fields. 


Select OK. 


Cycle power on the emulation probe. The new addresses will take 
effect after you do this. 
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Setting up a Point-to-Point Connection 


A point-to-point connection creates an isolated network with only two 
nodes—the logic analysis system and the emulation probe. 


There are two ways to set up the connection: 


If you have this equipment... Use this procedure 


Emulation probe and a logic “To set up a point-to-point connection with an 
analysis system with an E5901B = emulation module” on page 38 
emulation module 


Emulation probe and a logic “To set up a point-to-point connection without 
analysis system without an an emulation module” on page 39 
E5901B emulation module 


To set up a point-to-point connection with an 
emulation module 
Connect the emulation module to the emulation probe (page 47). 


Connect the crossover LAN cable between the logic analysis system 
and the emulation probe. 


In the logic analysis system main window, open the System 
Administration dialog and check that networking is enabled. 


Select the emulation module icon then select Start Session.... 


This will automatically configure the LAN connection and start the Emulation 
Control Interface. There is no need to set the IP address of the emulation 
probe. 
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To set up a point-to-point connection without an 
emulation module 


Connect the crossover LAN cable between the logic analysis system 
and the emulation probe. 


Turn on power to the emulation probe. 


In the logic analysis system main window, select the System 
Administration icon. 


Select Network Setup.... 


5 Select Standard to turn on networking. 


Select Default Network. 


Leave the network parameters with the default values. The IP address should 
be 192.0.2.231. 


7 Inthe Network Setup dialog, select OK. 


12 
13 


In the main system window, select the Workspace icon. 
Drag the emulation probe icon onto the workspace. 

From the emulation probe icon, select Init Probe LAN Addresses... 
Enter the link-level address of the emulation probe. 


The link-level address (LLA) is printed on a label above the LAN connector on 
the emulation probe. 


Enter the following IP address: 192.0.2.233 


Select 0K then follow the instructions. 


Note about the Setup Assistant: If networking is dzsabled for the 16700-series 
logic analysis system, the Setup Assistant will guide you through the process 
of setting up a point-to-point connection. If networking is enabled, the Setup 
Assistant assumes you want to connect the emulation probe to a site LAN. 
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Verifying LAN Communications 


Verify your emulation probe is now active and on the network by issuing a 
ping or telnet command to the IP address. 


To verify LAN communications using ping 


These instructions assume you are using a PC running Microsoft® Windows® 


95 or Windows® 98. The procedure for other operating systems is slightly 
different. 


1 Open an MS-DOS window or select Start—Run.... 


2 Enter the ping command followed by the IP address of the emulation 
probe. 


Example 
C:\WINDOWS>ping 192.35.12.6 

Pinging 192.35.12.6 with 32 bytes of data: 
Reply from 15 
Reply from 15 


Reply from 15 
Reply from 15 


253.138: bytes=32 time=1ms TTL=254 
253.138: bytes=32 time=1ms TTL=254 
253.138: bytes=32 time=1ms TTL=254 


SOs 
nor 
(Ss 
-6.253.138: bytes=32 time<10ms TTL=254 


If You Have Problems If the response is something like "100% packet loss" or "Destination host 
unreachable", see “Problems with the LAN Interface” on page 156. 
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To verify LAN communications using telnet 


Verify your emulation probe is now active and on the network by 
issuing a telnet to the IP address. 


This connection will give you access to the emulation probe’s built-in terminal 
interface. 


To view the LAN parameters, enter the lan command at the terminal 
interface prompt. 


To exit from this telnet session, type <CTRL>D at the prompt. 


The best way to change the emulation probe’s IP address, once it has already 
been set, is to telnet to the emulation probe and use the terminal interface lan 
command to make the change. Remember, after making your changes, you 
must cycle power before the changes take effect. Doing this will break the 
connection and end the telnet session. 


To use telnet on a 16700-series logic analysis system, select the System 
Administration icon, select the Networking tab, then select telnet... 


“Problems with the LAN Interface” on page 156. 


Example 


$ telnet 192.35.12.6 

R>lan 

lan is enabled 

lan -i 192.35.12.6 

lem =G 0.0.0.0 

lan -s 255.255.248.0 

lan -p 6470 

Ethernet Address : 08000F090B30 
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Installing the Emulation Module 


This chapter shows you how to install an emulation module in your Agilent 
Technologies 16700-series logic analysis system and how to connect the 
emulation module to an emulation probe. 


You need to set up a LAN connection for the E5900B emulation probe, even if 
you are using an E5901B emulation module. 


If your emulation module is already installed in your logic analysis system 
frame, you may skip this chapter. 


CAUTION: Electrostatic discharge can damage electronic components. Use grounded 
wrist straps and mats when you handle modules. 
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To install the emulation module in an Agilent 16700- 
series logic analysis system or expansion frame 


You will need T-10 and T-15 Torx screw drivers (supplied with the emulation 
module) 


1 Turn off the logic analysis system and REMOVE THE POWER CORD. 
Remove any other cables (including mouse or video monitor cables). 
2 Turn the logic analysis system frame upside-down. 


3 Remove the bottom cover. 


4 Remove the slot cover. 


You may use either slot. 
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5 Install the emulation module. 


6 Connect the cable and re-install the screws. 


You may connect the cable to either of the two connectors. 


7 Reinstall the bottom cover, then turn the frame right-side-up. 


8 Plug in the power cord, reconnect the other cables, and turn on the 
logic analysis system. 


The new emulation module will be shown as an "E5901B Emulation Module" in 
the system window. 
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Installing the Emulation Module 


To connect the E5901B emulation module to the 
E5900B emulation probe 


1 Connect one end of the module/probe interconnect cable to the 


E5901B emulation module in the logic analysis system mainframe. 


2 Connect other end of the module/probe interconnect cable to the 


"Emulation Module" connector on the E5900B emulation probe. 


3 Power on the emulation probe. 


The LED next to the switch is lit when the switch is turned on and the probe is 
being supplied with power. 


Power is supplied by the 16700-series logic analysis system through the 
module/probe interconnect cable. The external power supply is not necessary 
for normal operation. 


Chapter 2, “Connecting the Emulation Probe to a LAN,” beginning on page 27. 
(You need to connect the emulation probe to the LAN, even when you are 
using an emulation module.) 


Chapter 6, “Connecting the Emulation Probe to Your Target System,” 
beginning on page 65. 
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Installing Software on a 16700-Series Logic Analysis System 


This chapter explains how to install the software you will need for your 
analysis probe or emulation solution. 


Installing and loading 


Installing the software will copy the files to the hard disk of your logic 
analysis system. Later, you will need to load some of the files into the 
appropriate hardware module. 


Logic analysis system or logic analyzer 


Install Load Logic analyzer 
CD-ROM or : : 
flexible disk Hard Disk or emulation 
ne module 
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What needs to be installed 


HP 16600A/700A-series logic analysis systems 


If you ordered an emulation solution with your logic analysis system, the 
software was installed at the factory. 


The following files are installed when you install a processor support package 
from the CD-ROM: 


Logic analysis system configuration files 

Inverse assembler (automatically loaded with the configuration files) 
Personality files for the Setup Assistant 

Emulation module firmware (for emulation solutions) 


Emulation Control Interface (for emulation solutions) 


The HP B4620B Source Correlation Tool Set is installed with the logic analysis 
system’s operating system. 
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To install the software from CD-ROM 
(16600A/700A) 


Installing a processor support package from a CD-ROM will take just a few 
minutes. If the processor support package requires an update to the Agilent 
Technologies 16600A/700A operating system, installation may take 
approximately 15 minutes. 


If the CD-ROM drive is not connected, see the instructions printed on the CD- 
ROM package. 


Turn on the CD-ROM drive first and then turn on the logic analysis 
system. 


If the CD-ROM and analysis system are already turned on, be sure to save any 
acquired data. The installation process may reboot the logic analysis system. 


Insert the CD-ROM in the drive. 

Click the System Administration icon. 

Click the Software Install tab. 

Click Install... 

Change the media type to "CD-ROM" if necessary. 
Click Apply. 


7 From the list of types of packages, double-click "PROC-SUPPORT." 


10 


A list of the processor support packages on the CD-ROM will be displayed. 
Click on the "ARM" package. 


If you are unsure whether this is the correct package, click Details for 
information about the contents of the package. 


Click Install. 
The Continue dialog box will appear. 
Select Continue. 


The Software Install dialog will display "Progress: completed successfully" 
when the installation is complete. 
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11 Ifrequired, the system will automatically reboot. Otherwise, close the 
software installation windows. 


The configuration files are stored in /logic/configs/hp/arm. The inverse 
assemblers are stored in /logic/ia. 

See Also The instructions printed on the CD-ROM package for a summary of the 
installation instructions. 


The online help for more information on installing, licensing, and removing 
software. 


To list software packages which are installed (16700) 


In the System Administration Tools window, click List... . 
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Designing a Target System 


This chapter will help you design a target system that will work with the 
emulation probe. 


The Agilent Technologies emulation probe is connected to a target system 
through one of the IEEE 1149.1 (JTAG) Port connectors. The included 
connectors are: 

e §6Agilent/ARM 20-pin low density (0.100 inch pin spacing) 

e §6Agilent/ARM 20-pin high density connector 

e ARM EmbeddedICE 14-pin (0.100 inch pin spacing) 

e VLSI Jumpstart 14-pin (0.100 inch pin spacing) 

e TI XDS510 14-pin (0.100 inch pin spacing) 


NOTE: The 14-pin connectors are supported by the emulation probe, but should not be 
designed into new systems due to their susceptibility to noise and cross-talk. New 
designs should use the Agilent/ARM 20-pin connector described below. 


This section will help you design a target system that will work with the Agilent 


Technologies emulation probe. 
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Agilent/ARM 20-pin low density connector and 
Agilent/ARM 20-pin high density connector pinout 


The following diagram shows the pinout for both 20-pin low density and 20- 
pin high density connectors. 


PI VTref ) O} Pin 2. Vsupply 1 XI) 2 
Pin 3: nTRST | O OF Pin 4 GND x 
Pin WV] oo InN 6 GND Xx 
Pin IMS | Oo in & GND x 
Pin 9 aS OO) Pin 10 GND x 
Pin 11 RTCK 7 OO} Pin 12 GND | — 494 mm 
Pin 13: TDO )O]} Pin 14. GND Le 1.100 in 
Pin 15. nSRS exe) in 16. GND 
Pin 17: DBGRQ | CO O} Pin 18 GND xy] 
Pin 19 DBGACK | © ©} Pin 20: GND x 
19|&X 20 
: 2.54 mi 
Lo acs 
23459210 
NOTE: The 20-pin low density connector is strongly recommended for new designs. 


Agilent Technologies E5900B Emulation for ARM 57 


Designing a Target System for an Emulation Probe 
Designing a Target System 


Signal descriptions (20-pin connectors) 


Required Signals 


VTref signal. The VTref signal is used to sense when the target system is 
connected to the emulation probe. This signal is also used as a reference voltage for 
all signals driven by the emulation probe as well as for a threshold reference for 
received signals. The emulation probe does not use this pin for power. 


TDI signal. The TDI signal is a core JTAG signal and should be connected to TDI 
on the target. 


TDO signal. The TDO signal is a core JTAG signal and should be connected to 
TDO on the target. 


TCK signal. The TCK signal is a core JTAG signal. 


TMS signal. The TMS signal is a core JTAG signal. 


Strongly recommended signals 


nTRST signal. The nTRST signal is the JTAG reset signal. Most target systems 
implement a reset by holding TMS high for 5 consecutive clock cycles. nTRST can 
be used as a substitute for that operation. 


DBGRQ signal. The DBGRQ signal is used to quickly enter debug mode after 
receiving a "BREAK IN" signal from the logic analyzer. This allows the logic 
analyzer triggering capability to be used for complex breakpoints. Without DBGRQ, 
the processor must be stopped by using the JTAG scan chains, and the processor 
may not stop until several hundred instructions have been executed. This may cause 
complications when attempting to correlate the state of the logic analyzer and the 
emulation probe after the breakpoint has been reached. In general, DBGRQ is much 
more useful than DBGACK for system debug. 


DBGACK signal. The DBGACK signal is used to quickly detect entry or exit 
from debug mode. If DBGACK is available, then the "TRIGGER OUT" signal from 
the emulation probe can be used to start or stop the logic analyzer. Without 
DBGACK, the emulation probe must do polling over the JTAG scan chains to 
determine when the processor is in debug mode. Without the use of DBGACK, there 
will be a substantial and variable delay between the processor stopping and 
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"TRIGGER OUT" being driven. This may cause some difficulty in correlating the 
trace of the logic analyzer with the exact time that the processor entered debug 
mode. 


Optional signals 


VSupply signal. The VSupply signal is used by some JTAG controllers as a 
power source. The emulation probe does not use this pin for power. This pin should 
be left unconnected if it is not available. If it is available, then the emulation probe 
can accept 0 V - 5 V at this pin. 


nSRST signal. The nSRST signal is a current limited, open collector signal that is 
driven and monitored by the emulation probe. nSRST is connected to the ARM 
signal nRESET. If this signal is not available, then the emulation probe will be 
unable to reset the target system. 


RTCK. RTCK is the Return Test Clock signal from the target JTAG port to the 

JTAG interface unit. Some targets need to synchronize the JTAG port to internal 

clocks. To assist in meeting this requirement, RTCK, which is a returned (and re- 
timed) TCK, can be used to dynamically control the TCK rate. Targets that don’t 
require RTCK should tie it to a fixed signal level. 


Electrical requirements for the TDO, TDI, TCK, 
TMS and nTRST signals 


TDO, TDI, TCK, TMS and nTRST signal traces between the JTAG connector and 
the ARM target must be less than 3 inches long. If these signals are connected to 
other nodes, the other nodes must be daisy chained between the JTAG connector at 
one end and the ARM microprocessor at the other end. These signals are sensitive to 
crosstalk and must not be routed along active signals such as clock lines on the 
target board. 


The TDI, TCK, TMS and nTRST signals must not be actively driven by the target 
system when the debug port is being used. 


Place the connector as close as possible to the processor to ensure signal integrity. 
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14-pin connectors 


If your target system already has a 14-pin connector, you may use the existing 
connector; however, noise and/or crosstalk may cause problems. 


ARM EmbeddedICE 14-pin connector 


The following diagram shows the pinout for the ARM EmbeddedICE connector. 


Pin VIref} O OF} Pin 2 GND 
Pin 3. ATRST | O OF Pin 4. GND 
Pin 5. TI O} Pin 6. GND 
Pin 7 >) Pin 8: GND 
Pin 9 Pin 10° GND 
Pin 11 Pin 12° nSRST 
Pin 13 Pin 14. GND 


ARM EmbeddedlCE 14-pin Connector 


TI 14-pin connector 


The following diagram shows the pinout for the TIXDS510 14-pin connector. 


In OO] Pin 2: ATRST 
Pin 3 |} OO} Pin 4 GND 
Pin 5: TVCC | O OC} No pin (key 
Pin 7; TDOL O ©} Pin 8: GND 
in 9: TCK_RE O ©} Pin 10: GND 
Pin 11: TCK | O O} Pin 12: niICERST 
Pin 13: EMUOQ | O O} Pin 14: EMU1 
e3459e 


TI XDS510 14-pin Connector 
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VLSI 14-pin connector 


The following diagram shows the pinout for the VLSI Jumpstart 14-pin 
connector. 


*PN[2:0] and PT are used for the VLSI MDP board 
and are grounded on other VLSI targets. 


VLSI Jumpstart 14-pin Connector 
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Signal descriptions (14-pin connectors) 


This section describes signals which differ from the descriptions of the signals for 
the Agilent/ARM 20-pin connector, which is described on page 58. 


ARM 14-pin connector 
TDO, TDI, TMS,TCK: Same as Agilent/ARM 20 pin 


VTref signal. The VTref signal is used to sense when the target system is 
connected to the emulation probe. This signal is also used as a reference voltage for 
all signals driven by the emulation probe as well as for a threshold reference for 
received signals. The emulation probe does not use this pin for power. 


nTRST: Input: The nTRST signal is the JTAG reset signal. Most target systems 
implement a reset by holding TMS high for 5 consecutive clock cycles. nTRST can 
be used as a substitute for that operation. 


nSRST: Input: target reset. 


TI 14-pin connector 

TDO, TDI, TMS,TCK: Same as Agilent/ARM 20 pin. 

TVCC: Output from target system; 0 to | volt > system is not powered. The 
emulation probe will not drive TDO, TDI, TMS,TCK. | to 5 V > the target system 
is powered. The emulation probe will drive TDO,DTI,TMS,TCK. 

EMU0, EMU1: No connection on emulation probe. 


nICERST: Input: target reset. 


VLSI 14-pin connector 
TDO, TDI, TMS,TCK: Same as Agilent/ARM 20 pin. 
+5V: Output. No connection on emulation probe. 


3.3V: Output. 0 to 1 volt > system is not powered. The emulation probe will not 
drive TDO, TDI, TMS,TCK. | to 5 V > the target system is powered. The 
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emulation probe will drive TDO,DTLTMS,TCK. 
nRST: Input: target reset. 


PN0/GND, PN1/GND, PN2/GND,PT/GND: Target input. On most VLSI 
targets these pins are grounded. On the VLSI MDP board these pins are inputs to the 
target which select which processor is being addressed. The emulation probe drives 
these pins with a high on PT and a low on PNO, PN1, PN2. 
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Pullup/Pulldown resistor connections 


The following table shows recommended pullup and pulldown resistor 
connections. The table is presented for 20-pin connectors. To apply this 
information to 14-pin connector configurations refer to the "Signal Name" 
column and ignore the "20-Pin Header Number" column. 


ARM Connections 


20-Pin 

Header 

Number Signal Name Board Resistor 
1 VTref series 1 kQ or less 
2 Vsupply 

3 nTRST 10 kQ pullup 

4 GND 

5 TDI 10 kQ pullup 

6 GND 

7 TMS 10 kQ pullup 

8 GND 

9 TCK 10 kQ pullup 
10 GND 

11 RTCK 10 kQ pullup 
12 GND 

13 TDO no pullup/down 
14 GND 

15 nSRST 10 kQ pullup 
16 GND 

17 DBGRO 10 kQ pulldown 
18 GND 

19 DBGACK no pullup/down 
20 GND 
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Connecting the Emulation Probe to Your Target System 


This chapter explains how to connect the emulation probe to the target 
system and how to configure the emulation probe and target. 


Here is a summary of the steps for connecting and configuring the emulation 
probe: 


1 Make sure the target system is designed to work properly with the 
emulation probe. (See page 56.) 


2 Install the emulation module in your logic analysis system, if necessary. 
(See page 43.) 


3 Connect the emulation probe to your target system using the ribbon 
cable. (See page 67.) 


4 Update the firmware of the emulation probe, if necessary. (See page 
117) 


5 Configure the emulation probe. (See page 71.) 


6 Connect a debugger to the emulation probe, if applicable. (See page 
105.) 


See Also Chapter 9, “Using the Emulation Probe with a Debugger,” beginning on page 
105 for information on configuration with a debugger. 
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To connect the emulation probe to the target 
system 


The emulation probe may be connected to your target system through one of 
five types of headers, depending on which connector is installed on the target 
system. See page 56 for a list of connector types. 


The emulation probe should be connected to the target system using one of 
the ribbon cables provided. You may also need to use one of the adapter 
boards provided. 


Turn off power to the target system. 


If you plan to connect the emulation probe to a powered target system, 
configure the emulation probe for hot plugging (see page 90). 


Turn off power to the emulation probe. 


The target system and/or the emulation probe may be damaged if the correct 
connector board is not used! 


Select the appropriate ribbon cable and connector board: 


Target System Connector aU rare Connector Board 
20-pin low density E3459-61605 none 

20-pin high density E3459-61601 E8130-66513 
ARM EmbeddedlCE 14-pin £3459-61602 E8130-66505 
VLSI Jumpstart 14-pin E3459-61602 E8130-66513 

TI XDS510 14-pin E3459-61602 E8130-66513 


Insert the connector board into the emulation probe. 


Skip this step if you are using the 20-pin low density cable. It connects directly 
to the emulation probe without a connector board. 
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Using the Agilent E8130-66513 Connector Board 
Insert the board into the emulation probe, then plug a ribbon cable into one of the three sockets. 


Connect to E5900B 
emulation probe 


TI 14-pin connector We 


. . VLSI 14-pin connector 
Agilent/ARM 20-pin 


high density connector 


Using the Agilent E8130-66505 Connector Board 
Insert the board into the emulation probe, then plug the ribbon cable into the 14-pin socket. 


Connect to E5900B 
emulation probe 


ARM EmbeddedICE 14-pin 
connector 
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Using the 20-pin low density cable (adapter board not required) 
Plug the ribbon cable into the emulation probe. 


5 Connect one end of the cable to the appropriate socket on the 
connector board. 


NOTE: If you are using a 14-pin socket on the E8130-66513 board, be sure to use the 
appropriate socket. They are marked "TT" and "VLSI." 


CAUTION: The target system and/or the emulation probe may be damaged if not properly 
connected. 
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Connecting the Emulation Probe to Your Target System 
To connect the emulation probe to the target system 


NOTE: Connecting the ribbon cable to the JTAG debug port on the target system or 
analysis probe is possible without halting processor execution (see page 90). 


6 Plug the other end of the cable into the JTAG debug port on the target 
system or on the analysis probe. 


CAUTION: Observe connector orientation and connect pin 1 of the cable to pin 1 of the 
target system. If the connector is rotated, your target system or the emulation 
probe may be damaged. 


7 Turn on power to the emulation probe. 
8 Turn on power to the target system. 


After you have connected the emulation probe to your target system, you may 
need to update the firmware in the emulation probe. 


See Also For information on designing a debug port on your target board, see page 55. 


For a list of the parts supplied with the emulation probe, see page 18. 
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Configuring the Emulation Probe 


The emulation probe has several user-configurable options. These options 
may be customized for specific target systems and saved in configuration files 
for future use. 


The easiest way to configure the emulator is through the Emulation 
Control Interface in an Agilent Technologies 16600A or 16700A logic 
analysis system. 


If you use the Emulation Control Interface, please refer to the online help in 
the Configuration window for information on each of the configuration 
options. 


Other ways to configure the emulation probe are by using: 


e The emulation probe’s built-in terminal interface 
e Your debugger, if it provides an “emulator configuration” window which 
can be used with this Agilent Technologies emulation probe 


What can be configured 


The following options can be configured using the Emulation Control 
Interface or using built-in commands: 


Processor type 

Availability of DBGACK and DBGRQ signals 
Restriction to real-time runs 

JTAG clock speed 

Fast JTAG parameter 

Memory model 

Coprocessor register RAM address 
Debug communications channel 
Describing coprocessors 

Reset behavior 

Vector catch register 

Trigger out behavior 

Break in behavior 

Voltage reference 

Voltage threshold 
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To configure using the Emulation Control Interface 


The easiest way to configure the emulation probe is to use the Emulation 
Control Interface in an Agilent 16700-series logic analysis system. 


1 Start an Emulation Control Interface session. 


In the system window, click the Emulation Control Interface icon, and then 
select Start Session.... 


2 Open a Configuration window. 


Select Configuration... from the Emulation Control Interface icon or from 
the Navigate menu in any Emulation Control Interface window. 


[Xl Configuration - Emulator<1> | | x] 


File Navigate Help 


Slot 1 
Emulation Module 


=) End Session... 


"Break In" Port: Break On Rising Edge — 
"Trigger Out" Port: High On Break — 


‘Run Control... 
Load Executable... 
Breakpoints... 


RESCH oe JTAG Clock Speed: 10 MHz = 
Memory... 
1/0... The signal DBGACK is available: Yes — 
Memory Disassembly... 
Status/Error Log... The signal DBGREQ is available: Yes — 
Command Line... 
Estee ees Memory System Endian Mode: Little as 
Processor Type? Arm?TOMI — 
3 Set the configuration options, as needed. 
Configuration changes will take effect when you close the configuration 
window or when you move the mouse pointer outside the window. 
4 Save the configuration settings. 
To save the configuration settings, open the File Manager window and click 
Save.... 
See Also Help—Help on this window in the Configuration window for information on 


each of the configuration options. 


Help in the Emulation Control Interface menu for help on starting an 
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Emulation Control session. 


To configure using the built-in commands 


If you are unable to configure the emulation probe with the Emulation Control 
Interface or a debugger interface, you can configure the emulation probe 
using the built-in “terminal interface” commands. 


Connect a telnet session to the emulation probe over the LAN. 
For example, on a UNIX system, for an emulation probe in Slot 1 enter: 
telnet LAN address 6472 

Enter cf to see the current configuration settings. 


Use the c£ command to change the configuration settings. 


Enter help cé€ for help on the configuration commands. 


For information on connecting the emulation probe to a LAN, see Chapter 2, 
“Connecting the Emulation Probe to a LAN,” beginning on page 27. For 
information on built-in commands, see page 146. 
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Example 


To see a complete list of configuration items, type help cf. This 
command displays: 


cf - display or set emulation configuration 


cft - display current settings for all config items 
cf <item> - display current setting for specified <item> 
cf£ <item>=<value> - set new <value> for specified <item> 
cf <item> <item>=<value> <item> - set and display can be combined 
help cf <item> - display long help for specified <item> 
--- VALID CONFIGURATION <item> NAMES --- 

proc - Set type of Arm Processor 

reset - RESET actions 

rrt - Enable or Disable Restriction to Real-Time Runs 

breakin - Select SMB break input option 

trigout - Select SMB trigger output option 

dbgack - Toggle availability of DBGACK 

dbgreq - Toggle availability of DBGREQ 

speed - Set JTAG Clock Divisor 

endian - Specify Big or Little Endian 

cparea - RAM region used by cpreg command 

comms - Enable debug communications channel polling 


M> 


To see amore detailed description of any configuration item, use the 
command “help cf <item>”. For example: 


M>help cf rrt 
Enable or Disable Restriction of Real-Time Runs 


cf rrt=no 
cf rrt=yes 


When enabled and while the processor is running the user program, any 
command that requires a break to the monitor will be rejected except ‘rst’, 
Ds, Sr KOT ge aur 


When disabled, commands that require a break to the monitor will always be 
accepted. 
M> 
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Configuring the Emulation Probe 


To see a list of the current configuration settings, use “cf”: 


M>cf 
cf proc=Arm7TDMI 
cf reset=auto 
cf rrt=no 
cf breakin=rising 
cf trigout=monhigh 
cf dbgack=no 
cf dbgreq=no 
cf speed=3 
cf endian=little 
cf cparea=20 
cf comms=off 
cf vref=external 
cf thresh=1/2 
cf fastjtag=no 
cf hotplug=no 


To configure using a debugger 


Because the Agilent Technologies emulation probe can be used with several 
third-party debuggers, specific details for sending the configuration 
commands from the debugger to the emulation probe cannot be given here. 
However, all debuggers should provide a way of directly entering terminal 
mode commands to the emulation probe. Ideally, you would create a file that 
contains the modified configuration entries to be sent to the emulation probe 
at the beginning of each debugger session. 


Information about specific debuggers in Chapter 9, “Using the Emulation 
Probe with a Debugger,” beginning on page 105. 


Your debugger manual. 
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Configuration Items 


The configuration items must be set correctly for each target system. 


To set the type of ARM processor 


Processor 


Built-in command 


ARM/7TDMI" (default) 


cf proc=Arm7TDMI 


ARM7DI cf proc=Arm7DI 
ARM710T cf proc=Arm710T 
ARM720T cf proc=Arm720T 
ARMSTDMI cf proc=Arm9TDMI 
ARM740T cf proc=Arm740T 
ARM 920T cf proc=Arm920T 
ARM 922T cf proc=Arm922T 
ARM 925T cf proc=Arm925T 
ARM 940T cf proc=Arm940T 
ARM 946ES cf proc=Arm946ES 
ARM 966ES cf proc=Arm966ES 


The c£save -s command will store the processor type configuration in the 
emulation probe’s flash memory. The c£save -xr command will restore this 


configuration. 
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To configure the availability of DBGACK and DBGRQ 


The Agilent Technologies emulation probe will make use of the DBGACK and 
DBGRQ signals if they are available on the debug port connector. 


The DBGACK signal allows the emulation probe to quickly detect entry or exit 
from debug mode. Also, the emulation probe is able to start or stop the logic 
analyzer through the "TRIGGER OUT" of the emulation probe. 


The DBGRQ signal is used to quickly enter debug mode after receiving a 
"BREAK IN" signal from the logic analyzer. This allows the logic analyzer 
triggering capability to be used for complex breakpoints. 


To make use of these signals, the emulation probe must be configured 
correctly. The following cf commands allow the specification of whether each 
signal is connected or not. 


Emulator configuration 


Value Emulator configured for Built-in command 

yes The corresponding signal is cf dbgack=yes 
connected and willbe used bythe cf dbgreq=yes 
emulator. 

no The corresponding signal is not cf dbgack=no 


connected and will notbe used by — cf dbgreq=no 
the emulator. (Default) 
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Configuration Items 


To configure restriction to real-time runs 


Real-time runs configuration 


Value 


Emulator configured for Built-in command 


no 


Allows commands which break to the cf rrt=no 
monitor. Examples include commands which 

display memory or registers. These 

commands break to the monitor to access 

the target processor, then resume the user 

program. (Default) 


yes 


No commands are allowed which break to cf rrt=yes 
the monitor, except “break,” “reset,” “run,” 

or “step.” The processor must be explicitly 

stopped before these commands can be 

performed. 


If your debugger allows displaying or modifying memory or registers while the 
processor is running, you must set rrt=no in order to use this feature. 
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Configuration Items 


To configure the JTAG clock speed (communication 
speed) 


The emulation probe needs to be configured to communicate at a rate which is 
compatible with your target processor. The JTAG clock speed is independent 
of processor clock speed. 


Some target systems that have additional loads on the JTAG lines, and some 
target systems do not quite meet the requirements (described in Chapter 5, 
“Designing a Target System for an Emulation Probe,” beginning on page 55). 
In these cases, setting the speed to a slower setting may be required to allow 
the emulation probe to work. 


The speed value is a number followed by either K, which indicates the value is 
in kHz, or M, which indicates the value is in MHz. The clock can be set to 
speeds in the range 391kHz to 40MHz. Not all values in this range are valid; if 
an invalid speed is entered, the next slower valid speed will be used. If you 
issue a break command and get the message "Unable to break," the speed may 
be set too high. Use the "cf speed=valwe" command to reduce the speed and 
break execution. 


Entering c£ speed without a value will display the current JTAG clock 
speed. 


JTAG clock speed configuration 


Value Built-in command 


391K - 40M cf speed=value 
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JTAG clock speed - fastjtag parameter 


An additional configuration item, "fastjtag", controls when TDO data is 
latched. When "fastjtag" is configured to "yes," the Agilent emulation probe 
does not comply with JTAG timing parameters; however, this allows 
communication with the target at greater clock speeds provided the target 
does not violate standard JTAG timing parameters. When "fastjtag" is set to 
"ves," the maximum clock speed is 40MHz. 


Value Meaning Supported: clock Built-in command 
speeds 
yes TDO is latched late to allow §391kHz-40MHz_ cf fastjtag=yes 
maximum target clock speed. 
no Complies with JTAG timing 391kHz - 10MHz_ cf fastjtag=no 
parameters. 


When "fastjtag" is set to "no," 1OMHz is the highest speed you should enter 
using the "cf speed" command. Entering a value greater than 10MHz will 
probably result in communication errors between the emulation probe and the 
target. Enter a speed of 10MHz or less to restore communication between the 
emulation probe and the target. 


“Configuring the Emulation Probe for Maximum Performance” on page 94 


To configure the endian mode of the target system 


Because the ARM processor is capable of being configured as either big- 
endian or little-endian, the emulation probe must know which configuration 
the target system is configured for. 


Processor endian configuration 


Value Emulator configured for Built-in command 
little Little endian (Default) cf endian=little 
big Big endian cf endian=big 


Agilent Technologies E5900B Emulation for ARM 81 


Configuring the Emulation Probe 
Configuration Items 


To configure the coprocessor register RAM address 


Reading and writing coprocessor registers requires a small area of target 
system RAM. The contents of this RAM is saved before the RAM is used and 
the original contents is restored after it is used. The cparea configuration 
item specifies the starting address of an 80 byte block of target system 
memory that must be readable and writable by the emulation probe. The 
default address is 20. 


For example: 


cficparea=40 


will start the cparea at address 40. 


To configure debug communications channel polling 
Debug communication channel configuration 


Value Meaning Built-in command 


off Disables polling for the debug cf comms=off 
communications channel. 


on Enables polling for the debug cf comms=on 
communications channel. 
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Configuring the Emulation Probe 
Configuration Items 


To set up the debug communication channel 


Use the following commands to setup and use the debug communication 
channel. 


Action 


comm -b 


Binary data upload (max=64 values). 

Record format: The first 2 bytes indicate the record length in 32-bit words. A 
termination record (0x00, 0x00) follows. 

Example output for 10 words: 

0x000a (Data for 10 4-byte words) 

0x0000 (Termination record) 


comm -C 


Displays comms control register status. 

Example Output: 

control=0 Write and read registers are clear. 

control=1 Data written to the comms data read register. 
control=2 Data available in the comms data write register. 
control=3 Data available in both registers. 


comm -d 


Display comms data buffer (max=64 values) Example output: 
Count=2 
XXXXXXXX 
XXXXXXXX 


comm -m <count>, 


<value0>, <value!>... 


Modify comms data read register. 


comm -m <count> 


Number of values to be entered (max=64). 


comm -r 


Clear the write buffer. 


comm -v 


Enables verbose messages for data in comms data buffer. 


comm -v enable 


Enables verbose messages for data in comms data buffer. (Same as comm -v.) 


comm -v disable 


Disables verbose messages for data in comms data buffer. 


comm -w 


Display the number of words in the comms write buffer 


See Also 


See ARM’s data sheet for more information on the debug communications 
channel. 
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Configuration Items 


To configure the emulation probe to work with a 
coprocessor 


The firmware supports the description and access of coprocessors for the 
ARM core. Use the following commands to describe coprocessors. 


cpdesc -d <CP#> <type> <reg> <size> <nbit> <rdbits> 
cpdesc -r <CP#> R <reg> <size> <read0> <read1> 

cpdesc -r <CP#> W <reg> <size> <write0> <writel> 

cpdesc -r <CP#> B <reg> <size> <read0> <read1i> <write0d> 
<writel> 


cpreg [-r <read0>] <CP#> <veg> - displays coprocessor registration 


cpreg -s [-w <write0>] <CP#> <reg> <valuel> [<value2>] 
- sets the processor register 


cpdesc <CP#> - displays the description for the specified CP 


Parameter Description 
<CP#> The coprocessor number 
<type> R, W, or B for read, write, or both 
<reg> A single register number or range (eg: 1 or 3...6) 
<size> The size of register in bytes (hex) 
<nbit> Bit 22 in an LDC or SDC instruction 
<rdbits> Bits 15..12 in an LDC or SDC instruction 
<read0> Bits 7..0 in an MRC instruction 
<read1> Bits 23..16 in an MRC instruction 
<write0> Bits 7..0 in an MCR instruction 
<write1> Bits 23..16 in an MCR instruction 
NOTE: | cpdesc for a register already specified will overwrite previous data. 
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Example usage of cpdesc and cpreg 


To setup a description to read coprocessor 15 register 0 CD register) for the 
ARM720T. 


cpdesc -r15R040000_ #ID register, read only 
cpreg 15 0 #Reads CP15 r0 


To configure the reset behavior 


The reset configuration item controls what happens when a reset occurs. 


Reset configuration 


Value Emulator configured for Built-in command 


auto ARESET will break into monitorand cf reset=auto 
restore watchpoint registers only 
when watchpoint registers are 
being used. (Default) 


tomon (break) A RESET will break into monitor. cf reset=tomon 
Watchpoint registers will be 
restored. The processor will remain 
in monitor until another command 
causes it to exit. 


touser A RESET will not break into monitor. cf reset=touser 
(continue) Watchpoint registers will not be 

restored. 
restart A RESET will break into monitor. cf reset=restart 


Watchpoint registers will be 
restored and the user program will 
begin running. 


Note that these actions occur only when the RESET signal is not asserted. 
Selecting the Reset button in the Emulation Control Interface (or using the 
built-in rst command) asserts RESET continuously until another command 
causes RESET to be un-asserted. 
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To configure the vector catch register (ARM920T/922T/ 
/925T/940T/946T/966ES) 


This configuration item sets and displays the vector catch register, which 
defines which conditions will cause the processor to enter debug mode. 


Vector catch register configuration 


Bit Meaning Built-in command 

7 FIO cf veatch=value 
6 IRQ 

5 

4 D_Abort 

3 P_Abort 

2 SWI 

1 Undef 

0 Reset 

Example 


To set the vector catch register for SWI and RESET, set it to binary 
00000101: 


cf veatch=0x5 
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To configure the Monitor Mode (ARM946ES/966ES) 


This configuration item controls the monitor mode bit in the debug control 
register. 


Value Meaning Built-in command 


no Clears the monitor mode bit in the cf monitor=no 
debug control register (Default). 


yes Sets the monitor mode bit in the cf monitor=yes 
debug control register. 


To configure the Trigger Out SMB (Emulation Probe 
only) 


With an emulation module, this configuration item is always set to the default 
setting and cannot be changed with a cf command. The Intermodule window 
of the logic analyzer must be used instead. 


Trigger out configuration 


Value The Trigger Out SMB will Built-in command 
fixhigh Always be high cf trigout=fixhigh 
fixlow Always be low cf trigout=fixlow 
monhigh Go high when the processor is cf trigout=monhigh 


running in background (Default) 


monlow Go low when the processor is cf trigout=monlow 
running in background 
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To configure the Break In SMB (Emulation Probe only) 


When the emulation probe is connected to an emulation module via the 
module/probe interconnect cable, this configuration item is always set to the 
default setting and cannot be changed with a cf command. The Intermodule 
window of the logic analyzer must be used instead. If you need to break on a 
falling edge, either trigger from the logic analysis system or use the emulation 
probe without the emulation module. 


If you need to break on a falling edge, either trigger from the logic analysis 
sytem or use the the emulation probe without the emulation module. 


Break in configuration 


Value The Break In SMB will Built-in command 

off Inputs to the Break In SMB willbe —_ cf breakin=off 
ignored. 

rising The emulator willcauseabreakon cf breakin=rising 


a rising edge. (Default) 


falling The emulator willcause a breakon cf breakin=falling 
a falling edge. 
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To configure the voltage reference 


The emulation probe uses the V,,, signal on the JTAG connector to determine 


logic high and logic low levels when driving the TDI and TCK signals. 


Value Meaning Built-in command 

external The voltage reference is generated by the cf vref=external 
target system.(Default) 

value The voltage reference of va/ue is generated cf vref=value 


internally by the emulation probe. The value 
is a number followed by either mV, which 
indicates the value is in millivolts, or V, which 
indicates the value is in volts. 


CAUTION 

This option should only be used if the core 
voltage is different than that of the Vref 
signal on the JTAG connector. Use this option 
with extreme care, because it is possible to 
damage the target system if the voltage level 
is chosen incorrectly. 


To configure the voltage threshold 


Threshold for voltage reference. Voltages above (vref*thresh) will be 
considered logic high and voltages below this level will be considered logic 


low. 
Value Built-in command 
1/2 (Default) cf thresh=1/2 
2/3 cf thresh=2/3 
1/3 cf thresh=1/3 
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To configure the probe for hot plug 


This configuration item allows the emulation probe to be connected to a target 
system without halting processor execution. Normally the nSRST line is held 
low, and connecting the JTAG connector to the target system causes the 
processor to reset. The cf hotplug configuration item holds the nSRST line at 
Vref when the emulation probe is hot plugged to the JTAG connector. 


Value 


Meaning 


Built-in command 


no 


The probe works normally (Default). 


cf hotplug=no 


yes 


The probe can be connected to a 
running target without causing the 
target to halt. 

The cf vref=value command must 
be issued to set emulation probe's 
internal voltage reference to the 
target's JTAG voltage reference before 
issuing the cE hotplug=yes 
command. 


cf hotplug=yes 
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To disconnect the emulation probe while the processor 
is running 


Connecting and/or disconnecting the emulation probe while the target 
processor is running is not recommended. Doing so may halt the target 
system. 


The following procedure will minimize the risk of halting the processor when 
the emulation probe is disconnected. 


Ensure that the emulation probe does not use the VTref pin on the 
JTAG connector for its voltage reference, since the connector will be 
disconnected. Use the c£ vref=value command to set the 
emulation probe's internal voltage reference to the target’s JTAG 
voltage reference instead of using the VTref pin. 


Issue the redis -c command. This will disable all the run control 
signals, tristating the output drivers from the emulation probe. Now 
you may disconnect the probe. 


The redis -s command will re-enable the signals. 
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Testing the emulation probe and target system 


After you have connected and configured the emulation probe, you should 
perform some simple tests to verify that everything is working. 


Chapter 13, “Troubleshooting the Emulation Probe,” beginning on page 135, 
for information on testing the emulation probe hardware. 


To test memory accesses 


Start the Emulation Control Interface and configure the emulation 
probe, if necessary. 


Open the Memory window. 


Write individual locations or fill blocks of memory with patterns of your 
choosing. 


The access size is the size of memory access that will be used to write or read 
the memory values. 


Use the Memory I/O window to stimulate I/O locations by reading and 
writing individual memory locations. 


To test with a running program 


To more fully test your target, you can load simple programs and execute 
them. 


Compile or assemble a small program and store it in a Motorola S- 
Record or Intel Hex file. 


Use the Load Executable window to download the program into RAM 
or flash memory. 


Use the Breakpoints window to set breakpoints. Use the Registers 
window to initialize register values. 
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The new register or breakpoint values are sent to the processor when you 
press the Enter key or when you move the cursor out of the selected register 
field. 


4 Inthe Run Control window, click Run. 


5 Use the Memory Mnemonic window to view the program and use the 
Memory window to view any output which has been written to memory. 
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Configuring the Emulation Probe for Maximum 
Performance 


The performance of the emulation probe depends on the speed at which it 
communicates with the target system. Better performance is obtained with 
faster communication speeds. 


Setting TCK speed 


On JTAG debug ports the communication speed is controlled by the clock 
signal TCK. This signal is generated by the emulation probe. You can set the 
speed of TCK using the Emulation Control Interface in a 16700-series logic 
analysis system or by using the c£ speed command through a telnet or 
debugger connection to the emulation probe. 


To change TCK speed, sendacf£ speed=x command to the probe. To restore 
default, send an init -c¢ command. For more information about cf speed, 
sendahelp cf speed command to the probe. Also note that some 
debuggers allow the speed to be set from within their GUI or from a command 
file. 


When to decrease TCK speed 


Emulation probes are configured at the factory with a default TCK speed. In 
most cases, this is equal to the maximum allowable speed as specified by the 
manufacturer (see the table). This speed is suitable for most applications. 
However, this speed is only valid if 1) the processor is running at it’s full rated 
speed, 2) trace lengths from the processor to the JTAG connector are short 
(two inches or less), and 3) there are no stubs on the JTAG signals. If the 
emulation probe cannot communicate reliably with the target system using the 
factory default speed, TCK speed must be reduced. 
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When to increase TCK speed 


Some target systems will allow TCK speeds greater than the default. The real 
maximum speed for a given target system can be determined empirically by 
increasing the speed and observing if the communication to the target is 
reliable. However, please note that speeds greater than the default are not 
officially supported by Agilent or the chip manufacturer. 


Manufacturer Emulation Probe Emulation 
Processor Spec.MaxTCK Factory DefaultTCK Probe Max TCK 
(MHz) (MHz) (MHz) 
ARM - 10 40 
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Configuring for Multiple Processor Systems 


The Agilent E5900B Option 300 emulation probe supports trace of multiple 
processors through a single JTAG scan chain. The emulation probe supports 
JTAG chain connections (TDO to TDI, not star) for up to 32 processors. The 
default configuration is for a single processor. 


Known and Unknown Processors 


In this chapter, “unknown” processor refers to processors in the JTAG scan 
chain which are not explicitly supported by the firmware (driver). 
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Configuring for Multiple Processor Systems 


To configure the emulation probe for multiple 
processor trace 


The jtagch command defines a list of processors for the JTAG scan chain. The 
firmware (driver) that has been loaded into the emulation probe supports a 
particular processor or a family of processors (e.g. ARM). The JTAG scan 
chain may contain processors both known and unknown by the emulation 
probe firmware. 


Command Syntax 


All processors must be specified in the JTAG scan chain (jtagch) list. The 
command syntax is as follows: 


jtagch <driver link|IR length 1>, 
[driver link|IR length 2], 
[driver link|IR length 3]... 


Values enclosed in <angle brackets> are required, values enclosed in [square 
brackets] are optional. The “!” symbol indicates “or.” 


The first processor in the list is identified as processor 1, the next processor is 
identified as processor 2, etc. A maximum of 32 processors (known and 
unknown) can be specified in the jtagch command. The default setting is 
jtagch a. 


Processors that are recognized by the emulation firmware are identified by 
driver link. Unknown processors are identified by IR length. Commas 
are used to separate processors in the jtagch list. The list of processors must 
contain at least one known processor. 


oe 


The driver link for the ARM family of processors is “a”. 


The IR length is the processor Instruction Register (IR) length in number 
of bits. 


To display the current list of valid processors, issue the command jtagch 
with no parameters. 
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To direct a command to a specific processor 


The sp command allows you to direct commands and data to and from a 
specific processor. Initially, ifan sp <processor identifier> command 
has not been issued, commands will be sent to the first known processor in the 
JTAG scan chain. Once the sp command has been used to address a particular 
processor, that choice will not change until another sp <processor 
identifier> command is issued or a system initialization occurs. The 
syntax for the sp command is: 


sp <processor identifier> 


The <processor identifier> must be set for a known processor in the JTAG 
scan chain list. 


The sp command without the <processor identifier> will display the current 
processor identifier. 


Numbering of processors for the <processor identifier> term includes all 
known and unknown processors. 

Given the JTAG scan chain: 

jtagcha,a 


To read the registers and memory location 100 in the first processor in the list, 
issue the command sequence: 


sp 1 
reg 
m 100 


To read the registers and look at the emulation status in the second processor, 
issue the command sequence: 


sp 2 
reg 
es 


Given the JTAG scan chain: 
jtagch 9,a,a 


To read the registers and memory location 100 in the second processor, issue 
the command sequence: 


sp 2 
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reg 
m 100 


To direct a command to all known (non-bypassed) 
processors 


Some commands can be issued to all know processors. These commands are: 


es all Display the emulation status of all known processors 
b all Break into all known processors 
r all Run all known processors 
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Multiple processor system example — one known 
processor and one unknown 


Consider a system of two processors in a serial JTAG chain configuration with 
a single LAN connection to the emulation probe. The JTAG chain contains one 
known processor while the other is an unknown processor (e.g. a DSP) which 
has a 9-bit instruction register (IR). 


TDI Processor 2 | TDO 
Emulation |__jw-|_ Processor 1 9-bit IR 
Probe BYPASS 
~<a 


To setup this JTAG connection use the following command: 
jtagch a,9 


The above jtagch command says that the first processor is known by a driver 
and it is linked to driver "a." The next processor (Processor 2) is not known 
and has an instruction register length of 9 bits. 


When the proper JTAG scan chain is set up, the emulation probe can issue 
commands and access resources for Processor 1 while Processor 2 is always 
placed in a bypass mode. The emulation probe will issue the proper JTAG scan 
chains so that the commands and data will be directed only to Processor 1. 
The connection will look just like a single processor connection. 


To enable Processor | breakpoint: 

be -e swhp 

To set a breakpoint for Processor 1 at address 0x1000: 

bp 1000 

Whenever the processor hits a breakpoint the following message is returned: 


!ASYNC STAT 615! Software breakpoint: 00001000 
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Multiple processor system example — two known 
processors, one unknown 


Consider a system of two known processors and one unknown processor. The 
unknown processor has an IR length of 9 bits. 


Emulation TDI Processor 2 TDO 
Probe -——t=>|Processor 1 >) 9-bit IR >| Processor 3 
BYPASS 


To setup this JTAG scan chain use the following command: 
jtagch a,9,a 


To issue commands to and receive data and messages from Processor 1 enter 
the command: 

sp 1 

then issue the desired commands. 


To issue commands to and receive data and messages from Processor 3 enter 
the command: 

sp 3 

then issue the desired commands. 


To enable Processor 1 breakpoints: 


spl 
be -e swbp 


To set a breakpoint for Processor | at address 0x1000: 


spl 
bp 1000 


To set a breakpoint for Processor 3 at address 0x2000: 


sp 3 
be -e swbp 
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bp 2000 
When processor | hits a breakpoint the following message is returned: 


!ASYNC STAT 615! Software breakpoint: 00001000: 
Processor 1 


When processor 3 hits a breakpoint the following message is returned: 
!ASYNC_STAT 615! Software breakpoint: 00002000: 


Processor 3 


NOTE: Other asynchronous messages will display the processor number at the end of 
the message only when there is more than one known processor in the JTAG 
scan chain. 
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Using the Emulation Probe with a Debugger 


Several prominent companies design and sell state-of-the-art source 
debuggers which work with the Agilent emulation modules and emulation 
probes. 


Benefits of using a debugger 


The debugger will enable you to control the execution of your processor from 
the familiar environment of your debugger. Using a debugger lets you step 
through your code at the source-code level. 


With a debugger connection, you can set breakpoints, single-step through 
source code, examine variables, and modify source code variables from the 
debugger interface. The debugger can also be used to download executable 
code to your target system. 


Using a debugger to connect to the emulation probe allows the entire design 
team to have a consistent interface from software development to hardware/ 
software integration. 


Debugger interfaces must be ordered directly from the debugger vendor. 


Compatibility with other logic analysis system tools 


You can use your logic analysis system to collect and analyze trace data while 
you use your debugger. You can use a web browser to display the logic 
analyzer windows right next to your debugger. 


Minimum requirements 
To use a debugger with the emulation probe, you will need: 


e A debugger which is compatible with the emulation probe 
e ALAN connection to the PC or workstation that is running the debugger 


e Aweb browser or X windows or an X terminal emulator, such as Reflection 
X ona PC. This is required only if you wish to have the logic analysis 
system user interface displayed on your PC or workstation screen, along 
with the debugger. 


Is your debugger compatible with the emulation probe? 


Ask your debugger vendor whether the debugger can be used with an Agilent 
emulation module or emulation probe. 
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LAN connection 

You will use a LAN connection to allow the debugger to communicate with the 
emulation probe. 

Compatibility with the Emulation Control Interface 

Do not use the logic analysis system’s Emulation Control Interface and your 
debugger at the same time. 

Connecting to an Emulation Module 


If you are using an E5901B emulation module, configure your debugger to use 
the IP address of the E5900B emulation probe, not the logic analysis system. 


You may need to tell the debugger which port number to use. The default port 
number for a debugger connection is 6470. 


Do not use the Emulation Control Interface at the same time as a debugger. 
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Setting up Debugger Software 


The instructions in this manual assume that your PC or workstation is already 
connected to the LAN, and that you have already installed the debugger 
software according to the debugger vendor’s documentation. 


To use your debugger with the emulation probe, follow these general steps: 


e¢ Connect the emulation probe to the LAN (see page 30). 


e Connect the emulation probe to your target system (see page Chapter 6, 
“Connecting the Emulation Probe to Your Target System,” beginning on 
page 65). 

e Ifyou are using a logic analysis system, export the logic analysis system's 
display to your PC or workstation (page “To export the logic analysis 
system’s display to a workstation” on page 109). 


e Configure the emulation probe (page “Configuring the Emulation Probe” 
on page 71). 
e Begin using your debugger. 


If you use the Emulation Control Interface to configure the emulation probe, 
remember to end the Emulation Control Interface session before you start the 
debugger. 


Do not use the Emulation Control Interface at the same time as a debugger. 
The Emulation Control Interface and debuggers do not keep track of 
commands issued by other tools. If you use both at the same time, the tools 
may display incorrect information about the state of the processor, possibly 
resulting in lost data. 


Refer to the documentation for your debugger for more information on 
connecting the debugger to the emulation probe. 


To export the logic analysis system’s display to a web 
browser 
You can export the display of an Agilent 16700-series logic analysis system to 


your PC or workstation using a web browser. See the online help in your logic 
analysis system for more information. 
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To export the logic analysis system’s display to 
a workstation 
By exporting the logic analyzer’s display, you can see and use the logic 


analysis system’s windows on the screen of your workstation. To do this, you 
must have telnet software and X window installed on your computer. 


On the workstation, add the host name of the logic analysis system to 
the list of systems allowed to make connections: 


xhost +<IP_address> 


Use telnet to connect to the logic analysis system. 


telnet <IP_address> 
Log in as “hplogic”. 


The logic analysis system will open a Session Manager window on your 
display. 


In the Session Manager window, click Start Session on This Display. 


On a UNIX workstation, you could use the following commands to export the 
display of a logic analysis system named “mylogic”: 


S$ xhost +mylogic 

S$ telnet mylogic 

Trying... 

Connected to mylogic.mycompany.com. 
Escape character is ‘*]’. 

Local flow control on 

Telnet TERMINAL-SPEED option ON 


HP Logic Analysis System 
Please Log in as: hplogic [displayname: 0] 


login: hplogic 
Connection closed by foreign host. 
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To export the logic analysis system’s display to a PC 


By exporting the logic analyzer’s display, you can see and use the logic 
analysis system’s windows on the screen of your PC. To do this, you must have 
telnet software and an X terminal emulator installed on your computer. The 
following instructions use the Reflection X emulator from WRQ, running on 
Windows 95, as an example. 


1 Onthe PC, start the X terminal emulator software. 

To start Reflection X, click the Reflection X Client Startup icon. 
2 Start a telnet connection to the logic analysis system. 

Log in as “hplogic”. 


For Reflection X, enter the following values in the Reflection X Client Startup 
dialog: 


a Inthe Host field, enter the LAN name or IP address of the logic 
analysis system. 


b Inthe User Name field, enter “hplogic”. 
c Leave the Password field blank. 

d_ Leave the Command field blank. 

e Click Run to start the connection. 


The logic analysis system will open a Session Manager window on your 
display. 


3 In the Session Manager window, click Start Session on This Display. 
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Compatibility 


The ARM Debugger for Windows (ADW) and ARM Developer Suite v1.0 or 
greater are two of the debuggers that connect to the Agilent Technologies 
emulation probe. ADW is part of the Software Development Toolkit (SDT), 
available from ARM Ltd. Only versions of the SDT greater than v2.11la support 
the use of an Agilent Technologies emulation probe. 


This section provides information that is specific to using ADW with the 
emulation probe. It should be used in conjunction with the more detailed SDT 
user documentation provided by ARM. In the case of any conflict between 
these two sources, the SDT documentation should be considered definitive. 


Overview 
Host Computer Emulation 
probe or Logic 
ADW Analysis 


System with 
probe module 
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Getting Started 


1 Connect and set up the emulation probe or logic analysis system as 
described in the Agilent Technologies documentation. 


Ensure that the file ‘gateway.dll’ is placed in the ‘bin’ sub-directory of the 
ADW installation directory. Depending on the intended target system, one or 
more Gateway Configuration ‘.gcf’ files should also be placed in this same 
directory. The relationship between target and configuration file is given in 
the following table: 


Target File 
ARM 7TDMI gate_arm7tdmi.gcf 
ARM 710T gate_arm710t.gcf 
ARM 720T gate_arm720t.gcf 
ARM 740T gate_arm740t.gcf 
ARM 920T gate_arm920t.gcf 
ARM 940T gate_arm940t.gcf 
ARM 966ES gate_arm966es.gcf 


The list given in this table is not exhaustive. See the table on page 77 for a 
complete list of compatible processor types. 


2 Configure the ARM Debugger for Windows. 


The ARM Debugger for Windows must be configured prior to use with the 
emulation probe. 


a Start ADW and allow it to initialize normally. 


If no errors occur, choose Options->Configure Debugger from the 
ADW menu to display the configuration dialog for ADW. 


If an initialization error does occur, then choose Cancel and enter 
Armulator mode (SDT versions prior to v2.50) then choose Options- 
>Configure Debugger again, or simply click on the Configure 
button when this is presented as an option (SDT v2.50 and higher). 

The configuration dialog actually consists of a number of tabbed pages, a 
particular page being chosen by clicking on the corresponding tab. Select 
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the Target tab of the dialog. 
b Select gateway. 


If gateway has been used previously, then click on the target environment 
combo box to display the list of known environments and ensure that 
gateway is selected. 


If a version of gateway has not been installed previously, it must be added 
to the list of target environments supported by ADW. Do so by clicking on 
the Add button on the dialog and then opening the gateway.dll file. This 
automatically makes gateway the selected environment. 


ec Configure gateway. 


Click on the Configure button to display the configuration parameters 
specific to gateway. These include the currently used network location of 
the emulation probe, the target processor type, and a list of channel 
viewers. Selecting a channel viewer involves checking the Enabled 
checkbox and highlighting the particular viewer in the list. There are also 
Add and Remove buttons to enable the list to be manipulated. Please see 
the relevant ARM documentation for details of channel viewers and their 
usage. 


Click on the Set button to alter the network location and target type 
parameters. A further dialog is then displayed where the new address can 
be entered and a target selected from those supported by the emulation 
probe. Note that there may be a short delay before display of this dialog as 
a connection is made to the emulation probe. 


Click OK to dismiss the gateway configuration dialog. Change parameters 
listed on other pages of the configuration dialog as appropriate. In 
particular, make sure that the target endian mode is set up correctly on 
the Debugger page. Finally click OK again to dismiss the ADW 
configuration dialog. ADW should restart without errors using the new 
configuration. 
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To Perform Common Debugger Tasks 


To download an image, choose File->Load Image from the ADW 
command menu. The Load Image file dialog is displayed and can be used to 
locate and select the image file. During a download the number of bytes 
written and read is displayed as a progress indicator. Once the operation is 
complete, the execution window of ADW will show the start of the 
disassembled code. If the image contains debug information and has been 
compiled from ’C’ sources a breakpoint is automatically inserted by ADW at 
the start of the mainQ procedure. 


To start execution of a downloaded image, choose Execute->Go 
from the ADW menu. Note that the initial value of the PC will have been set 
appropriately as a result of the download. 


To stop the target, choose Execute->Stop from the ADW menu. A 
subsequent Execute->Go will start the target running from the current value 
of the PC. 


To set or clear a breakpoint, select the line in the execution window 
and choose Execute->Toggle Breakpoint. If no breakpoint exists at this 
location it is added, while an existing breakpoint will be cleared. This can only 
be done while the target is stopped. 


To set a watchpoint, select View->Variables and choose either local or 
global. This displays respectively the variables that are local to the current 
procedure or global within the application. Selecting the value of interest and 
choosing Execute->Toggle Watchpoint sets the watchpoint. 


To display or modify registers, choose View->Registers and select 
the desired register bank (that is, the set of registers for a particular ARM 
processor mode). All of the registers in that bank are then displayed in a 
separate window. To change the value of a register, double-click on the 
displayed value in this window. A further dialog box is then displayed from 
which a new value for that register can be set. These operations can only be 
carried out when the target is stopped. 
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To step through code, choose Execute->Step. Various other stepping 
options are also available from the execute menu such as Step In, Step Out 
and Run to Cursor. 


Note that the above operations can be carried out in a variety of other ways, 
for example shortcut keys or toolbar buttons. See ARM documentation for 
further details. 


Error Conditions 


The emulation probe can detect and report to ADW that the target power is 
switched off. However, if the emulation probe is not connected or powered 
down, ADW will appear to hang for approximately 1 minute during start-up. 
This is simply a network time-out. ADW will then report that it could not 
initialize the communications link. Under these circumstances, check all 
connections and ensure that the address of the emulation probe has been 
correctly specified. The behavior is similar if the TIM has been disconnected 
from the emulation probe. In this case, the error reported will be failure to 
enter monitor mode. 


Starting up ADW after the target has been power cycled may result in 
repeated warnings that the probe cannot read memory. This is not a problem 
and occurs as a result of the debugger attempting to access memory around a 
non-valid value in the pc register. The debugger’s execution window may be 
all or partially blank as a result of these errors. 


If certain sensitive operations, such as downloading memory, are interrupted, 
subsequent attempts to start up ADW may result in an error message stating 
that the probe could not enter monitor mode. Under these circumstances it 
may be necessary to cycle power to the probe and target. 


The ARM Web Site: http://(www.arm.com 
The Software Development Toolkit User Guide. 
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Updating Firmware 


Firmware gives your emulation probe a “personality” for a particular processor 
or processor family. 


After you have connected the emulation probe to your target system, you may 
need to update the firmware to give it the right personality for your processor. 


Update the firmware if: 


e You need to change the personality of the emulation probe for a new 
processor. 


e You have an updated version of the firmware from Agilent Technologies. 
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Updating Firmware When You Do Not Have a 
Logic Analysis System 


To display current firmware version information 


Use telnet to access the built-in "terminal interface" and use the ver 
command to view the version information for firmware currently in the 
emulation probe. 


To update firmware from the web 


To update the firmware, you must have access to the World Wide Web and a 
PC or a workstation connected to your emulation probe. 


Download the new firmware from the following World Wide Web site: 


http://www.agilent.com/find/emulator 


The firmware will be in the "Emulator and Emulation Solutions Software" or 
“Technical Support” section of this web site. 


Follow the instructions on the web site for installing the firmware. 


To update firmware from a floppy disk 


Follow the instructions on the README file on the floppy disk. 


The firmware can be installed using either a PC or a workstation which can 
read PC disks. 
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Updating Firmware When You Have a Logic 
Analysis System 


Always update firmware by installing a processor support package. This will 
ensure that the version of the Emulation Control Interface software is 
compatible the version of the emulation probe firmware. Logic analysis system 
operating system CD-ROMS include the processor support packages; versions 
1.51 and later will include firmware which is compatible with E5900B 
emulation probes. 


To display current firmware version information 


1 Inthe Update Firmware window, select Display Current Version. 


There are usually two firmware version numbers: one for “Generics” and one 
for the personality of your processor. 


To update firmware using the Emulation Control 
Interface 


1 End any run control sessions which may be running. 
2 Install the processor support package from the CD-ROM, if necessary. 


3 Open the Update Firmware window. 


For an emulation module: In the system window, select the emulation module 
and select Update Firmware... 


Select 5} |15.19.3.24 


ES5901B Emulation Module 


| Connect to Emulator... 
Modify Interconnected Probe LAN Addresses... 
Update Firmware... 
Performance Verification... 
Help... 
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For an emulation probe: In the Workspace window, drag the emulation probe 
icon onto the workspace then select Update Firmware... 


In the Update Firmware window, select the firmware to load into the 
emulation module. 


Select Update Firmware. 


In about 80 seconds, the firmware will be installed and the screen will update 
to show the current firmware version. 


“Installing Software” beginning on page 50 for instructions on how to install 
the processor support package from the CD-ROM. 


To update firmware for an emulation module using the 
Setup Assistant 
The Setup Assistant is an online tool for connecting and configuring your logic 


analysis system for microprocessor and bus analysis. The Setup Assistant is 
available on Agilent 16700-series logic analysis systems. 


This menu-driven tool will guide you through the connection procedures for 
connecting the logic analyzer to an analysis probe, an emulation module, or 
other supported equipment. It will also guide you through connecting an 
analysis probe to the target system. 


Install the processor support package from the CD-ROM. 


Start the Setup Assistant by selecting its icon in the system window. 


Follow the instructions displayed by the Setup Assistant. 


Page 50 for instructions on how to install a the processor support package 
from the CD-ROM. 
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CAUTION: 


This chapter will tell you how to install an Agilent E5902B emulation 
migration so that you can use your emulation probe with a new processor 
family. 


The E5902B emulation migration can be used with any E5900B emulation 
probe. It cannot be used with E5900A emulation probes. 


To install the emulation migration 


Electrostatic discharge can damage electronic components. Use grounded 
wrist straps and mats. 


The tools necessary for this procedure are supplied with the emulation 
migration. 


1 Turn off power to the emulation probe. 


Disconnect all cables from the emulation probe, including the power 
cord, LAN cable, serial cable, module/probe interconnect cable, and 
target cable. 


3 Remove the cover from the emulation probe: 


a Remove the 2 nuts and 2 screws from the front of the emulation 
probe. 


* Agilent 
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b Remove the front panel. 


ce Grasp the top cover with one hand. With the other hand, pull the 
plate on the bottom of the emulation probe, so that the top cover 
slides off. 
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4 Remove the 3 nylon screws from the emulation probe personality 
board. 


5 Carefully lift the emulation probe personality board from the main 
circuit board. 


Do not turn on power to the emulation probe when no emulation probe 
personality board is installed. 


You cannot run performance verification tests or make any measurements 
without a emulation probe personality board. 


6 Install the new emulation probe personality board on the main circuit 
board. 
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Align both connectors and press down firmly. 


7 Replace the 3 nylon screws. 


8 Reinstall the cover on the emulation probe: 


10 
11 


12 


13 


a_ Slide the top cover into place. 


b Assemble the new front panel. 


ce Attach the front panel using the 2 screws and 2 nuts. 


Connect the LAN cable, module/probe interconnect cable (if you will 
be using the emulation probe with an emulation module), and the LAN 
cable to the emulation probe. Do not connect a target cable yet. 


Turn on power to the emulation probe. 
Update the emulation probe’s firmware. 


See Chapter 10, “Updating Firmware,” beginning on page 117 for instructions 
on how to update firmware. 


Run the performance verification test. 
See page 162 for instructions on testing the emulation probe. 
Connect the emulation probe to your target system. 


See Chapter 6, “Connecting the Emulation Probe to Your Target System,” 
beginning on page 65, and your emulation or solution User’s Guide for 
instructions on how to make this connection. 
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Specifications and Characteristics 


The following operating characteristics are not specifications, but are typical 
operating characteristics for the Agilent Technologies E5900B emulation 
probe and E5901B emulation module. 


Processor compatibility 


The Agilent Technologies emulation probe supports the following processors: 


Processor 


ARM7TDMI 
ARM7DI 
ARM710T 
ARM720T 
ARMSTDMI 
ARM740T 
ARM 920T 
ARM 922T 
ARM 925T 
ARM 940T 
ARM 946ES 
ARM 966ES 


The emulation probe supports clock speeds up to 40 MHz. 


The emulation probe supports operation from 1.2 V to 5.0 V. 
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Electrical Characteristics 


Maximum Ratings 


Characteristics for Agilent 


Technologies Emulation Probe SEL Min Es 
TDO,DBGACK, RTCK Vin 0.8x Vcc 

Vi 0.2xVec 

I. +1yA 

C, 15 pF 
TDI,TCK,TMS,TRST,DBGRO Von @ Ign = -32 mA 0.8x Vcc 

Voi @ Ion = 64 MA; Vee = 4.5 V 0.2xVec 
TDI,TMS,TRST,DBGRO C, 25 pF 
TCK C, 45 pF 
VTref! Vin 1.2V 5.0 V 

Vil 0.8V 
SRST? Vj @ 24 mA 0.5V 

C, 25 pF 


'VTref is used only to determine target powered status. The emulation 
probe does not draw power from this source. 


: Open collector output, pulled up to a generated voltage equivalent to the VTref voltage with a 2.61 k ohm pullup 
resistor. 
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Trigger Out SMB Port 


With a 50 Q load, a logic high is > 2.0 V, and a low is < 0.4 V. The output 
function is selectable (see “To configure the Trigger Out SMB 
(Emulation Probe only)” on page 87). 


Break In SMB Port 


Edge-triggered TTL level input, 20 pF, with 4.6 kQ to ground in 
parallel. Maximum input: +5 V to -5 V when the trace port analyzer is 
powered OFF; +10 V to -5 V when the trace port analyzer is powered 
ON. Input function is selectable (see “To configure the Break In SMB 
(Emulation Probe only)” on page 88). 


Communications 


10BASE-T LAN Port. RJ-45 connector. IEEE 802.3 1OBASE-T 
(StarLAN). 


10BASE 2 LAN Port. 50-ohm BNC connector. IEEE 802.3 10OBASE2 
(ThinLAN). When using this connector, the Agilent Technologies emulation 
probe provides the functional equivalent of a Medium Attachment Unit (MAU) 
for ThinLAN. 


Power Supply 
Input. 100-240 V, 9.75 A, 50/60 Hz, IEC 320 connector. 


Output. 12 V,3.3A 
CAT I (Mains isolated). 
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Emulation probe environmental characteristics 


Temperature Operating, 0 C to +40 C (+32 to +104 F) 
Nonoperating, -40 to +60 C (-40 to +140 F). 


Altitude Operating/nonoperating 4600 m (15 000 ft). 
Relative Humidity 15% to 95%. 


Pollution Degree Pollution degree 2: Normally only dry non-conductive pollution occurs. 
Occasionally a temporary conductivity caused by condensation may occur. 


For indoor use only. 


Emulation module environmental characteristics 


The Agilent E5901B emulation module meets the environmental 
characteristics of the logic analysis system in which it is installed. 
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Troubleshooting the Emulation Probe 


If you have problems with the emulation probe, your first task is to determine 
the source of the problem. Problems may originate in any of the following 
places: 

e The connection between the emulation probe and your debugger 

e The emulation module or emulation probe itself 

e The connection between the emulation probe and the target system 

e The target system 


You can use several means to determine the source of the problem: 
e The troubleshooting guide beginning on the next page 

e The status lights on the emulation probe 

e The emulation probe "performance verification" tests 


e The emulation probe's built-in commands 
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Troubleshooting Guide 


If you have trouble using the emulation probe, the following steps may help 
you identify the problem: 


Step 1: Telnet to the emulation probe 


Use telnet to connect to the emulation probe across the LAN. For instructions 
on how to do this, see “Verifying LAN Communications” on page 40. 


The emulation probe must be reachable via LAN before you can use it. 


If you cannot connect to the emulation probe 


If you cannot ping or telnet to the emulation probe (“Verifying LAN 
Communications” on page 40): 


See “Problems with the LAN Interface” on page 156. 


If you need to change the LAN parameters of the emulation probe, see 
Chapter 2, “Connecting the Emulation Probe to a LAN,” on page 27. 


Step 2: Check the prompt 


Once you have connected to the emulation probe, press the Enter key a few 
times and look at the prompt which is displayed. 


If a telnet connection to the emulation probe 
displays the prompt "->" 
The "->" prompt indicates that the firmware loaded into the emulation probe is 


not compatible with the "emulation probe personality board" which is located 
inside the emulation probe. 


Try one of the following until you get a different prompt: 
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Cycle power on the emulation probe. (Turn off your target power first.) 


Check that the proper firmware is installed for the emulation probe 
personality board or the type of emulation probe shown on the front 
panel of the emulation probe. 


The proper firmware is installed at the factory but it could accidentally be 
changed. A "ver" command will display the firmware which is currently loaded. 
Refer to “Updating Firmware” on page 117 if the firmware is incorrect. 


Run the performance verification tests. Refer to “To run the emulation 
probe performance verification tests” on page 162. 


Connection to the wrong target or connection to the target with the pins 
connected backward could potentially damage the emulation probe. Use the 
performance verification tests to validate that the emulation probe itself is 
working correctly. 


If a telnet connection to the emulation probe 
displays the prompt "?>" 


The "?>" prompt indicates that the emulation probe is having trouble talking 
to the target and it doesn’t know what state the target is in. 


Validate that the emulation probe is connect to a powered up target. 


Refer to Chapter 6, “Connecting the Emulation Probe to Your Target System,” 
beginning on page 65. 


Try initializing the emulation probe with the "init -c" command. 


Some emulation probes need to read the Processor Version Register of the 
target processor as the emulation probe is initialized. 


Check the emulation probe configuration settings. 


Enter the e£ command to display the configuration settings. Note that some 
emulation probes must set the processor type with 
cf proc=processor type. 


Decrease the JTAG communication speed. Some targets need slower 
speeds to properly communicate. 


Use the c£ speed command. 


Check that the proper firmware is installed for this processor. 
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Some PowerPC chips require different firmware to be installed for different 
mask revs or other slight differences of the processor. For example, the 
PowerPC 608ev processor requires that the E3479 firmware be installed and 
the Motorola PowerPC 608ei requires that the E3477i firmware be installed. 


Step 3: Try some simple commands to control the 
target 


Examples of some commands are listed in “What to check first” on page 148. 


If the emulation probe has problems controlling 
the target 


The emulation probe might be having problems controlling the target if you 
see messages such as: 


"Cannot break" 
"Processor is checkstopped" 
"Bad status code (0xff) received from the processor" 


Or the prompt changes to "?>" 


Problems controlling the target can be caused by a variety of conditions. 
Typically the problem is in the configuration of the emulation probe or the 
configuration of the target. 


Try the following to better control your target: 


Decrease the JTAG communication speed. Some targets need slower 
speeds to properly communicate. 


If you are using a telnet connection or a debugger command file, use the cf 
speed command. 


Check the emulation probe configuration settings. 


If you are using a telnet connection, enter the e¢£ command to display all of 
the configuration settings. 
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Pay particular attention to the cE proc=processor type line of the 
output. Ensure the processor type is set correctly. See “To set the type of ARM 
processor” on page 77 for instructions on setting the processor type. 


If your emulation probe does not have the correct firmware installed for the 
processor family that you are using (e.g. ARM7/9, MPC8260, PowerPC 7XX), 
you will need to load the appropriate firmware into the emulation probe. See 
“Updating Firmware” on page 117. 


Check that the emulation probe is not restricted to real-time runs. 


If you are using a telnet connection or a debugger command file, use the cf 
rrt=no command. 


Restrict to real time will not allow you to access memory or registers while the 
target is running. By setting this option to no, you will be able to access the 
memory and registers while the target is running. 


Check that the target processor is configured. 


Some target require configuration registers on the processor to be initialized 
before the emulation probe can properly communicate with the target. 


For example, the MPC860 requires memory chip selects to be defined before 
the target memory can be accessed. Other processors need their memory 
controllers initialized. 


To initialize the target processor, either run your target from reset (if you 
have a BOOT ROM) or define a series of emulation probe commands to 
initialize the target. 


Also refer to “Emulation Probe Built-in Commands” on page 145 for additional 
information about testing a target. 


Step 4: Check the emulation module 


If you are using an E5901B emulation module, select the emulation module 
icon and start the Emulation Control Interface. 
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If you have problems using the emulation probe 
as an emulation module in a 16700-series logic 
analysis system 

To use the emulation probe as an emulation module in a 16700-series logic 
analysis system you must have installed an E5901B emulation module and you 
must connect the emulation probe to the emulation module using the module/ 


probe interconnect cable. In addition, the emulation probe must be connected 
to the logic analysis system using a LAN. 


Check that the emulation probe and the logic analysis system are on 
the LAN. 


If you are using a site LAN you should be able to ping both the logic analysis 
system and the emulation probe. 


If you are using a point-to-point LAN connection you must use a special 
crossover LAN cable, such as the one supplied with the emulation module. 


The telnet window of the logic analysis system should be able to communicate 
with the emulation probe. This window can be found by selecting the "System 
Administration" icon in the main system window. 


Check that the emulation probe is connected to the emulation module 
with the module/probe interconnect cable. 


If this cable is connected, you should be able to display the firmware version 
from the "Update Firmware" window. 


Check that you have the proper processor support package installed. 


You can check this by selecting the System Administration icon in the main 
system window, then looking at the list of software packages installed. 


Test the emulation module. See page 161. 
Test the emulation probe. See page 162. 


Try using the Setup Assistant to configure your measurement setup. 


Step 5: Check your debugger connection 


If you are using a debugger, try connecting to the emulation probe. 
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If you have problems using the emulation probe 
with a debugger 

Most problems are associated with not having the emulation probe and target 
properly configured or initialized. 


Some debuggers have an initialization file that needs to be properly defined 
before a debugger can connect to the emulation probe. 


Make sure the PC or workstation where the debugger is running can 
ping the emulation probe. (See “Verifying LAN Communications” on 
page 40.) 


Initialize the emulation probe and target so that the debugger can 
connect. Refer to your debugger manual for proper initialization. 


Refer to your debugger manual for proper operation. 


If you need to obtain help 


If, after following the troubleshooting steps and looking through the other 
sections in this chapter, the emulation probe still is not working: 


Write down the target processor version, the emulation probe firmware 
version, and the type of emulation probe (E5900A or E5900B). 


Call your nearest Agilent Technologies sales or service office. 


To locate a sales or service office near you, go to http://www.tm.agilent.com 
and select Assistance. 
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Status Lights 


Emulation Probe Target Status Lights 


The emulation probe uses status lights to communicate various modes and 
error conditions. 


The following table gives more information about the meaning of the power 
and target status lights. 


O = LED is off 
@ = LED is on 


Power/Target Status Lights 


Pwr/Target : 

LEDs Meaning 

O RST No target system power, or emulation probe is not 

O DBG connected to the target system 

O RUN 

@ RST Target system is in a reset state 

O DBG 

O RUN 

O RST The target processor is in Debug Mode 

@ DBG 

O RUN 

O RST The target processor is executing user code 

O DBG 

@ RUN 

O RST Only boot firmware is good (other firmware has been 
@ DBG corrupted) 

@ RUN 

@ RST The emulation probe can no longer control the target. Reset 
@ DBG the target, then initialize the emulation probe. 

@ RUN 
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Emulation Probe LAN Status Lights 


8130215 


Yellow 


The yellow LED, on the right side of the connector, indicates LAN activity 
(receive or transmit). 


The green LED, on the left side of the connector, is lit when the LAN interface 
is operating in 100Base-Tx mode. 


Emulation Probe Power On Light 


ON/OFF ~~ 


The green LED, to the left of the power switch, is lit when the emulation probe 
is connected to a power source and the power switch is on. 
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Emulation Probe Built-in Commands 

The emulation probe has some built-in commands (sometimes called the 
“terminal interface”) which you can use for troubleshooting. 

You can enter the built-in commands using: 

e A telnet (LAN) connection 

e The Command Line window in the Emulation Control Interface 


e A “debugger command” window in your debugger 
e A serial connection (see page 32) 


To telnet to the emulation probe 


You can establish a telnet connection to the emulation probe if: 


e Ahost computer and the probe are both connected to a local-area network 
(LAN), and 


e The host computer has the telnet program (often part of the operating 
system or an internet software package). 


To establish a telnet connection: 
Find out the LAN address or LAN name of the emulation probe. 
Start the telnet program. 


If the LAN name of the emulation probe is “test2”, the command might look 
like this: 


telnet test2 
If you do not see a prompt, press the <Return> key a few times. 


To exit from this telnet session, type <CTRL>D at the prompt. 
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To use the built-in commands 


Here are a few commonly used built-in commands: 


Useful built-in commands 


b Break—go into the background monitor state 

cf Configuration—read or write configuration options 

help Help—display online help for built-in commands 

init Initialize—init -c re-initializes everything in the emulation 
probe except for the LAN software 

lan configure LAN address 

m Memory—read or write memory 

reg Register—read or write a register 

mtest Memory test—test target memory system 

r Run—start running user code 

rep Repeat—repeat a command or group of commands 

rst Reset—reset the target processor 

iS Step—do a low-level single step 

ver Version—display the product number and firmware version of the 


emulation probe 


Use help command_name to see the command syntax. For example, enter 
help mto get help on the memory command. 
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The prompt indicates the status of the emulation probe: 


Emulation probe prompts 


U Running user program 
M Running in debug mode 
p No target power 

R Emulation reset 

r Target reset 

? Unknown state 
Examples 


R>rst -m 
M>reg rO=ffff 
M>reg r0 

reg rO=O000fffE 


To break execution and then step a single instruction, enter: 


M>b 
M>s 
PC=XXXXXXXX 
M> 


enter: 


M>ver 


To set register r0, and then view r0 to verify that it was set, enter: 


To determine what firmware version is installed in the emulation probe, 


Use the help command for more information on these and other commands. 
Note that some of commands listed in the help screens are generic commands 


for Agilent emulation probes and may not be available for your product. 


If you are writing your own debugger, contact Agilent Technologies for more 


information. 
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Problems with the Target System 


What to check first 


Try some basic built-in commands (using a serial or telnet connection): 


U>rst 
R> 


This should reset the target and display an "R>" prompt. 


R>b 
M> 


This should stop the target and display an "M>" prompt. 


M>reg rl 
reg rl1=007fd6a0 
M> 
This should read the value of the rl register (the value will probably be 
different on your target system). 


M>m 0.. 
00000000 703043a6 7¢02802a6 7¢03143a6 4b£04111 
00000010 00000000 00000000 00000000 00000000 
00000020 00000000 00000000 00000000 00000000 
00000030 00000000 00000000 00000000 00000000 
00000040 00000000 00000000 00000000 00000000 
00000050 00000000 00000000 00000000 00000000 
00000060 00000000 00000000 00000000 00000000 
00000070 00000000 00000000 00000000 00000000 

M> 


This should display memory values starting at address 0. 
M>s 


This should execute one instruction at the current program counter. 


Note that stepping can fail if memory at the current PC does not contain a valid 
instruction. 


If any of these commands don’t work, there may be a problem with the design 
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of your target system, a problem with the revision of the processor you are 
using, or a problem with the configuration of the emulation probe. The 
following steps will help you identify the problem. 


Check that the emulation probe firmware matches your processor. To 
do this, enter: 


M>ver 
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To check the debug port connector signals 


Check for the following logic levels on the target debug port. The signal 
names are for the ARM7. 


Signal Levels with the emulation probe in default! reset state 


ARM/Agilent 


SignalName ARM 14-pin VLSI 14-pin TI 14-pin in Level 
Vec/VTref 1,13 13 5 1 1.2V-5.0 V2 
TDI 5 5 3 5 Toggling 
TDO 11 11 7 13 Toggling 
TCK s) 9 11 s) ~10 MHz signal 
TMS 7 7 1 7 Toggling 
nSYSRST 12 12 N/A 15 Low 
DBGACK N/A N/A N/A 19 Low 
DBGREQ N/A N/A N/A 17 Low 

nTRST 3 3 2 3 High 

PT N/A 10 N/A N/A High 

PN{3:0} N/A 46,8 N/A N/A Low 


All other pins should be low. 


'Default cf settings. 


“Target dependent. 
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To interpret the initial prompt 

The initial prompt can be used to diagnose several common problems. 
Connect the emulation probe to your target system. 

Set the default configuration settings. Enter: 


M>init -c 


You can enter this command at any prompt. The emulation probe will respond 
with the same information as printed by the "ver" command. 


If the response is "!ERROR 905! Driver firmware is 
incompatible with ID of attached device" 


Make sure the target interface module is connected to the cable of the 
emulation probe, then try the "init -c" command again. 


If the initial prompt is "p>" 

Check pin 1 on header Cif using the TI connector check pin 5 instead) 1.2V - 
5V (VDD). 

If the initial prompt is "M>" 

The processor entered debug mode without the help of the emulation probe. 
Is another debugger connected? 

If the initial prompt is "?>" 


Check TCK, TDO, TDI, TMS, and TRST_L signals. Check the firmware 
revision. 
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If the initial prompt is "R>" 


The emulation probe is scanning the JTAG correctly. Now you can do some 
more tests: 


Enter the reset command: 


R>rst 
R> 


The "R>" prompt is a good response that indicates that nRESET is working. 
Continue with "If the prompt after rst is R>". 


Enter the break command: 


R>b 
M> 


If the prompt after b is "U>" with error messages 


If you see: "ERROR 608! Unable to break”, try resetting the target 
and/or cycling power on the target. 


If the problem still persists, then try the sequence: 


U>rst 
R>r 
M>b 


Some ARM chips have problems if JTAG commands are issued while the chip 
is reset. Using the “rst”, “r”, “b” sequence avoids this problem. 


If the prompt after b is "M>" with no error messages 


Everything is still working correctly. Continue with more tests: 
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If you can get to the "M>" prompt 


At the "M>" prompt, check register and memory access: 


M>reg r0 


M>reg r0 


M> 


reg r0=xXXXxXXXXX 
M>reg r0=12345678 


reg r0=12345678 


chip is probably correct. 


Now enter: 


M>m -d4 -a 


M>m -d4 -a 


00000000 
00000010 
00000020 
00000030 
00000040 
00000050 
00000060 
00000070 
M> 


e Returned value is equal to the written value implies that memory is 


working. 


0=11111111, 22222222, 33333333,44444444 


0.5 
LEAT Wi 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 


22222222 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 


33333333 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 


44444444 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 
00000000 


If the returned value is equal to the written value, then the voltage level of the 


e Returned value is not equal to the written value implies that the memory 
controller may not be initialized. Be sure the memory controller for your 
target is setup correctly. 
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If you see memory-related problems 


Set caches and translation off. Refer to your target documentation for 
doing this. 


Now enter: 


M>m -d4 -a4 0211111111, 22222222, 33333333,44444444 

M>m -d4 -a4 0.. 
00000000 11111111 02222222 33333333 44444444 
00000010 00000000 00000000 00000000 OD0000000 
00000020 00000000 00000000 00000000 OD0000000 
00000030 00000000 00000000 00000000 OD0000000 
00000040 00000000 00000000 00000000 00000000 
00000050 00000000 00000000 00000000 00000000 
00000060 00000000 00000000 00000000 OD0000000 
00000070 00000000 00000000 00000000 OD0000000 

M> 


e Read value not equal to the written value implies that the memory 
controller is not setup correctly. 


e Read value equal to the written value implies that the emulation probe 
firmware might not be working with cache. 


Hand load the following small program: 


M>m -d4 -a4 100=e2811001,00000000,eafffffc 
M>reg rl1=0 
M> 


This means: Add rl, rl, #1, NOP, b 100 
Set the PC to this program: 


M>reg pc=100 
M> 


Step, then check the register: 


M>s 
pc=00000104 
M>reg rl 


reg r1=0000 0001 


M> 


This should return "reg rl1=00000001". 
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Step some more and verify that rl increments after every three steps: 


M>s 3 

pc=00000104 
M>reg rl 

reg r1=00000002 
M> 


If this does not work as described, make sure “cf endian” is set correctly for 
your target, the memory at 100 is read/write memory, and that the memory 
controller is programmed correctly. 
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Problems with the LAN Interface 


If you cannot verify LAN communication 


If you cannot verify connection using the procedure in "To verify LAN 
communication", or if commands are not accepted by the emulation probe: 


1 Make sure that you have connected the emulation probe to the proper 
power source and that the power light is lit. 


1 Make sure that you wait for the power-on self test to complete before 
connecting. 


1 Check that the Emulation Control Interface or debugger was configured 
with the correct LAN address. If the emulation probe is on a different 
subnet than the host computer, check that the gateway address is correct. 


(1 Make sure that the emulation probe’s IP address is set up correctly. To do 
this, connect the emulation probe to a terminal or terminal emulator and 
enter the lan command. (See “To configure LAN parameters using a serial 
connection” on page 32.) 


(1 Make sure that the gateway address is set up correctly. The default 
gateway address of 0.0.0.0 does not allow the emulation probe to 
communicate with computers on other subnets. 


LI Ifyou have just changed the IP address of the emulation probe, leave the 
emulation probe powered on and connected to the LAN for a few minutes, 
then try again. Some hubs, routers, and hosts maintain tables of IP 
addresses and link-level addresses. It may take a while for these tables to 
be updated. 


1 Make sure that the proper LAN cable is connected. 


e Use a Category 5 cable if your connection is running at 100 Mbps 
(100BASE-TX). 

e For a point-to-point connection, use a crossover cable. 

e Fora LAN connection, use a regular LAN cable, not a crossover cable 
(the cable supplied with the emulation module, part number 5061- 
7342, is a crossover cable). 
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Watch the LAN LED’s to see whether the emulation probe is seeing LAN 
activity. The LED’s are described on page 144. Refer to your LAN 
documentation for information on testing connectivity. 


It’s also possible for there to be a problem with the emulation probe 
firmware while the LAN interface is still up and running. In this case, you 
must reboot the emulation probe by turning the emulation probe power 
switch off then on again. 


If you have LAN connection problems 


a) 


Verify the IP address and gateway mask of the emulation probe. To do this, 
connect the emulation probe to a terminal or terminal emulator and enter 
the lan command. See “To configure LAN parameters using a serial 
connection” on page 32. 


If it takes a long time to connect to the network 


a) 


Check the subnet masks on the other LAN devices connected to your 
network. All of the devices should be configured to use the same subnet 
mask. 


Subnet mask error messages do not indicate a major problem. You can 
continue using the emulation probe. 

If there are many subnet masks in use on the local subnet, the logic 
analysis system may take a very long time to connect to the network after 
it is turned on. 


If you have problems setting the LAN parameters using 
a logic analysis system 


If the E5900B emulation probe is not connected to an E5901B 
emulation module, then make sure the emulation probe is on the same 
subnet as the logic analysis system during initial setup; otherwise, 
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probe LAN address setup will fail. After initial setup, you can modify 
the emulation probe’s LAN parameters using the Emulation Control 
Interface before moving the probe to a different subnet. 


(J Another thing that will cause emulation probe LAN address setup to 
fail is a BOOTP daemon, running elsewhere on your network, that is 
configured to respond to the link-level address of the emulation probe. 
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Problems with the Serial Interface 


If you cannot verify RS-232 communication 


If the emulation probe prompt does not appear in the terminal emulator 
window: 


a 


a 


Make sure that you have connected the emulation probe to the proper 
power source and that the power switch is on. 


Make sure that you have properly configured the data communications 
parameters on the host computer. 


Verify that you are using the correct cable. Use the cable and adapter 
which are supplied with the emulation probe. 


If you have RS-232 connection problems with the MS 
Windows Terminal program 


a) 


a 


Use the "HyperTerminal" program (usually found in the Accessories 
windows program group) and set up the "Communications..." settings as 
follows: 


Baud Rate: 9600 
Data Bits: 8 

Parity: None 

Stop Bits: 1 

Flow Control: None 


When you are connected, hit the Enter key. You should get a prompt back. 


If you still don’t get a prompt, make sure the serial cable is connected to 
the correct port on your PC. 


Make sure you are using the serial cable which was supplied with the 
emulation probe. 


With certain RS-232 cards, connecting to an RS-232 port where the emulation 
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probe is turned off (or is not connected) will hang the PC. The only way to get 
control back is to reboot the PC. Therefore, we recommend that you always 
turn on the emulation probe before attempting to connect via RS-232. 
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Problems with the Emulation Module 


Occasionally you may suspect a hardware problem with the emulation module. 
The procedure in this section describes how to test the emulation module 
hardware, and if a problem is found, how to repair or replace the broken 
component. 


This procedure tests the hardware within the logic analysis system—the 
emulation module and its connection to the logic analysis system. To test the 
emulation probe, see page 162. 


To test the emulation module 


End any Emulation Control Interface or debugger sessions. 
Disconnect the emulation probe from the target system. 

In the system window, select the System Admin icon. 

Select the Admin tab. 

Select Self-Test... 

Read the Question dialog and select Yes if you wish to run the self tests. 
Select the Master Frame tab. 

Select the £5901B Emulation Module. 

Select Test All. 


When you are finished running self tests, select Quit. Then restart your 
session from the Session Manager window. 
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Problems with the Emulation Probe 


To run the emulation probe performance verification 
tests 


In addition to the powerup tests, there are several additional performance 
verification (PV) tests available. 


These tests can be performed through a 16700-series logic analysis system or 
via a serial or telnet connection. 


Before running probe performance verification: 
e Leave the emulation probe connected to the LAN and to the power supply 
or module/probe interconnect cable. 


e Leave the emulation probe personality board installed inside the emulation 
probe. 

e End any Emulation Control Interface or debugger sessions. 

e Disconnect the target cable from the target system. (Power off the 
emulation probe while you do this.) 

e Connect an SMB cable from the "Break In" connector to the "Trigger Out" 
connector on the emulation probe. (If you aren't concerned about these 
signals, you may omit this step and ignore any related test failures.) 


To run the performance verification tests using the 
logic analysis system 


End any Emulation Control Interface or debugger sessions. 


Turn off the emulation probe and disconnect the emulation probe from 
your target system, then turn the emulation probe on again. 


Disconnect the emulation probe from your target system before running the 
tests. Running the Target Board Adapter Feedback Test with the target 
system connected can damage components on the target system. 
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In the system window, select the emulation probe icon then select 
Performance Verification. 


Select Start PV. 


The results will appear on screen. 


To run complete performance verification tests using a 
serial or telnet connection 


Connect an SMB (f) cable (such as Agilent 16532-61601) between 
BREAK IN and TRIGGER OUT. 


Disconnect the probe/module interconnect cable. 


Turn off the emulation probe and disconnect the emulation probe from 
your target system, then turn the emulation probe on again. 


Disconnect the emulation probe from your target system before running the 
tests. Running the Target Board Adapter Feedback Test with the target 
system connected can damage components on the target system. 


Connect the emulation probe to your PC or workstation using a serial 
or LAN connection, as described in “Connecting the Emulation Probe 
to a LAN” on page 27. 


Use a telnet or a terminal emulator to connect to the emulation 
probe. 


Enter the py 1 command. 


Options available for the py command are explained in the help screen 
displayed by typing help pv or? pvat the prompt. 


Examples 
Here are some examples of ways to use the pv command. 
To execute all of the tests one time: 


ivan 
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To execute test 2 with maximum debug output repeatedly until a Ctrl-c 
is entered: 


iW S12 avo) O 


The results on a good system, with the trigger out and break in SMBs 
connected, should similar to the following. 


U>pv 1 
Testing: HPE8130A Series Emulation System 
Test 1: Powerup PV Results Passed! 
Test 2: Emulation Module Port Feedback Test Passed! 
Test 3: Run Control FPGA Test Passed! 
Test 4: Run Control Clock Test Passed! 
Test 5: Break In and Trigger Out SMB Feedback Test Passed! 
Test 6: Target Board Adapter Feedback Test (FACTORY ONLY) Not Executed 
FAILED Number of tests: 1 Number of failures: 0 


Copyright (c) Agilent Technologies, Inc. 1999 
All Rights Reserved. Reproduction, adaptation, or translation without 
prior 
written permission is prohibited, except as allowed under copyright laws. 


HPE8130A Series Emulation System 
Version: A.01.00 Dec 30 1999 
Location: Generics 


HP E3454A PowerPC 700 JTAG Emulator 
Version: A.05.00 Oct 26 1999 
R> 


The product numbers and version information will be different for your 
emulation probe. The product numbers displayed are for the various 
pieces of firmware and will be different from the product number you 
used to order the product. 


If a performance verification test fails 


There are some things you can do if a failure is found on one of the tests. 
Details of the failure can be obtained through using a -v value (“verbose 
level”) of 9. 


If the particular failure you see is not listed below, contact Agilent Technologies for assistance. 


Test 1: Powerup PV Results 


Failure of this test indicates a hardware problem with the emulation probe. 
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Contact Agilent Technologies for assistance. 


Test 2: Emulation Module Port Feedback Test 


Failure of this test indicates a hardware problem with the emulation probe. 
Contact Agilent Technologies for assistance. 


This test exercises the hardware which drives the connection to the emulation 
module. It does not test the module/probe interconnect cable. 


The test is not executed if the emulation probe is connected to an emulation 


module. 


Test 3: Run Control FPGA Test 
Test 4: Run Control Clock Test 


Failure of these tests indicates a hardware problem with the emulation probe. 
Contact Agilent Technologies for assistance. 


If the emulation probe fails one of these tests, it may have been damaged by 
electrostatic discharge through the target cable. To prevent such damage in 
the future, follow standard ESD preventive practices. 


Test 5: Break In and Trigger Out SMB Feedback Test 


Before returning to Agilent Technologies, check to ensure that you have 
connected a good cable between the two SMB connectors. 


Test 6: Target Board Adapter Feedback Test 


Failure of this test indicates a hardware problem with the emulation probe. 
Contact Agilent Technologies for assistance. 


This test exercises the I/O circuitry. If the test passes, but the emulation 
probe seems to have trouble communicating with the target system, the 
problem is probably with the target system. 


If this test was not executed, it means that the target board adapter you are 
using does not support the test. 
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Returning Parts for Service 


The repair strategy for this emulation solution is board replacement. 


Exchange assemblies are available when a repairable assembly is returned to 
Agilent Technologies. These assemblies have been set up on the “Exchange 
Assembly” program. This lets you exchange a faulty assembly with one that 
has been repaired, calibrated, and performance verified by the factory. The 
cost is significantly less than that of a new assembly. 


To return a part to Agilent Technologies 


Follow the procedures in this chapter to make sure that the problem is 
caused by a hardware failure, not by configuration or cabling problems. 


In the U.S., call 1-800-403-0801. Outside the U.S., call your nearest 
Agilent sales office. Ask them for the address of the nearest service 
center. 


To locate a sales or service office near you, go to http://www.tm.agilent.com 
and select Assistance. 


Package the part and send it to the Agilent service center. 


Keep any parts which you know are working. For example, if only a cable is 
broken, keep the emulation probe. 


When the part has been replaced, it will be sent back to you. 


The unit returned to you will have the same serial number as the unit you sent 
to Agilent. 


In some parts of the world, on-site repair service is available. Ask an Agilent 
sales or service representative for details. 
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To obtain replacement parts 


The following table lists some parts that may be replaced if they are damaged 
or lost. The part numbers are subject to change. Contact your nearest Agilent 
Technologies sales office for further information. 


Exchange assemblies 


Part number Description 


E3459-69501 Rebuilt assembly (for ARM) 


Replacement assemblies 


Part number Description 

0950-3043 Power supply for emulation probe (marked F1044B) 
E3459-61601 20-pin high density cable 

E3459-61605 20-pin low density cable 

E8130-66505 ARM 14-pin cable adapter board 

E8130-66513 ARM TI/VLSI cable adapter board 

E3459-61602 14-pin JTAG cable 

16700-61608 Expansion cable for emulation module 

E8130-68702 Serial cable and adapter 

E8130-61601 14-pin module/probe interconnect cable 
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To clean the instrument 
If the instrument requires cleaning: 
Remove power from the instrument. 


Clean the instrument using a soft cloth that has been moistened in a 
mixture of mild detergent and water. 


Make sure that the instrument is completely dry before reconnecting it 
to a power source. 
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Analysis Probe A probing solution 
connected to the target 
microprocessor. It provides an 
interface between the signals of the 
target microprocessor and the inputs 
of the logic analyzer. Formerly called 
a “preprocessor.” 


Background Debug Monitor In 
Also called Debug Mode, In 
Background, and In Monitor. The 
normal processor execution is 
suspended and the processor waits 
for commands from the debug port. 
The debug port commands include 
the ability to read and write memory, 
read and write registers, set 
breakpoints and start the processor 
running (exit the Background Debug 
Monitor). 


Debug Mode See Background 
Debug Monitor. 


Debug Port A hardware interface 
designed into a microprocessor that 
allows developers to control 
microprocessor execution, set 
breakpoints, and access 
microprocessor registers or target 
system memory using a tool like the 
emulation probe. 


Elastomeric Probe Adapter A 
connector that is fastened on top of a 
target microprocessor using a 
retainer and knurled nut. The 


conductive elastomer on the bottom 
of the probe adapter makes contact 
with pins of the target 
microprocessor and delivers their 
signals to connection points on top of 
the probe adapter. 


Emulation Migration The 
hardware and software required to 
use an emulation probe with a new 
processor family. 


Emulation Module An emulation 
module is installed within the 
mainframe of a logic analysis system. 
An E5901A emulation module is used 
with a target interface module 
(TIM) or an analysis probe. An 
E5901B emulation module is used 
with an E5900B emulation probe 
and does not use a TIM. 


Emulation Probe An emulation 
probe is a stand-alone instrument 
connected via LAN to the mainframe 
of a logic analyzer or to a host 
computer. It provides run control 
within an emulation and analysis test 
setup. Formerly called a "processor 
probe" or "software probe." 


Extender A part whose only 
function is to provide connections 
from one location to another. One or 
more extenders might be stacked to 
raise a probe above a target 
microprocessor to avoid mechanical 
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contact with other components 
installed close to the target 
microprocessor. Sometimes called a 
"connector board." 


Flexible Adapter Two connection 


devices coupled with a flexible cable. 


Used for connecting probing 
hardware on the target 


microprocessor to the analysis probe. 


Gateway Address An IP address 
entered in integer dot notation. The 
default gateway address is 0.0.0.0, 
which allows all connections on the 
local network or subnet. If 
connections are to be made across 
networks or subnets, this address 
must be set to the address of the 
gateway machine. 


General-Purpose Flexible 
Adapter A cable assembly that 
connects the signals from an 
elastomeric probe adapter to an 
analysis probe. Normally, a male-to- 
male header or transition board 
makes the connections from the 
general-purpose flexible adapter to 
the analysis probe. 


High-Density Adapter Cable A 
cable assembly that delivers signals 
from an analysis probe hardware 
interface to the logic analyzer pod 
cables. A high-density adapter cable 
has a single Mictor connector that is 


installed into the analysis probe, and 
two cables that are connected to 
corresponding odd and even logic 
analyzer pod cables. 


High-Density Termination 
Adapter Cable Same as a High- 
Density Adapter Cable, except it has 
a termination in the Mictor 
connector. 


In Background, In Monitor See 
Background Debug Monitor. 


Inverse Assembler Software that 
displays captured bus activity as 
assembly language mnemonics. In 
addition, inverse assemblers may 
show execution history or decode 
control busses. 


IP address Also called Internet 
Protocol address or Internet address. 
A 32-bit network address. It is usually 
represented as decimal numbers 
separated by periods; for example, 
192.35.12.6. 


Jumper Moveable direct electrical 
connection between two points. 


JTAG (OnCE) port See debug 
port. 


Label Labels are used to group and 
identify logic analyzer channels. A 
label consists of a name and an 
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associated bit or group of bits. 


Link-Level Address The unique 
address of the LAN interface. This 
value is set at the factory and cannot 
be changed. The link-level address of 
a particular piece of equipment is 
often printed on a label above the 
LAN connector. An example of a link- 
level address in hexadecimal: 
0800090012AB. Also known as an 
LLA, Ethernet address, hardware 
address, physical address, or MAC 
address. 


Mainframe Logic Analyzer A logic 
analyzer that resides on one or more 
board assemblies installed in a 16500, 
1660-series, or 16600/700-series 
mainframe. 


Male-to-male Header A board 
assembly that makes point-to-point 
connections between the female pins 
of a flexible adapter or transition 
board and the female pins of an 
analysis probe. 


Monitor, In See Background 
Debug Monitor. 


Pod A collection of logic analyzer 
channels associated with a single 


cable and connector. 


Preprocessor See Analysis Probe. 


Preprocessor Interface See 
Analysis Probe. 


Probe Adapter See Elastomeric 
Probe Adapter. 


Prototype Analyzer The 16505A 
prototype analyzer acts as an analysis 
and display processor for the 16500B/ 
C logic analysis system. It provides a 
windowed interface and powerful 
analysis capabilities. Replaced by 
16600/700-series logic analysis 
systems. 


Run Control Probe See Emulation 
Probe and Emulation Module. 


Setup Assistant Wizard software 
which guides a user through the 
process of connecting and 
configuring a logic analyzer to make 
measurements on a specific 
microprocessor. The Setup Assistant 
icon is located in the main system 
window. 


Shunt Connector. See Jumper. 


Solution A set of tools for debugging 
your target system. A solution 
includes probing, inverse assembly, 
the B4620B Source Correlation Tool 
Set, and an emulation module. 


State Analysis When the logic 
analyzer is configured to capture data 
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synchronously with a clock signal in 
the target system. 


Subnet Mask A subnet mask blocks 
out part of an IP address so that the 
networking software can determine 
whether the destination host is on a 
local or remote network. It is usually 
represented as decimal numbers 
separated by periods; for example, 
255.255.255.0. 


Symbol Symbols represent patterns 
and ranges of values found on labeled 
sets of bits. Two kinds of symbols are 
available: 

1) Object file symbols — Symbols 
from your source code, and symbols 
generated by your compiler. Object 
file symbols may represent global 
variables, functions, labels, and 
source line numbers. 

2) User-defined symbols — Symbols 
you create. 


Target Board Adapter A daughter 
board inside the E5900B emulation 
probe which provides an interface to 
the ribbon cable for a particular 
microprocessor family. Also called 
emulation probe personality board. 


Target Control Port An 8-bit, TTL 
port on a logic analysis system that 
you can use to send signals to your 
target system. It does not function 
like a pattern generator or emulation 


module, but more like a remote 
control for the target’s switches. 


Target Interface Module A small 
circuit board which connects the 50- 
pin cable from an E5901A emulation 
module or E5900A emulation probe 
to signals from the debug port ona 
target system. Not used with the 
E5900B emulation probe. 


TIM See Target Interface Module. 


Timing Analysis When the logic 
analyzer is configured to capture data 
at arate determined by an internal 
sample rate clock, asynchronous to 
signals in the target system. 


Transition Board A board 
assembly that obtains signals 
connected to one side and rearranges 
them in a different order for delivery 
at the other side of the board. 


Trigger Specification A set of 
conditions that must be true before 
the instrument triggers. See the 
printed or online documentation of 
your logic analyzer for details. 


1/4-Flexible Adapter An adapter 
that obtains one-quarter of the 
signals from an elastomeric probe 
adapter (one side of a target 
microprocessor) and makes them 
available for probing. 
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A 


address, IP, 31 
altitude specifications, 133 
analysis probe 
connecting to, 67 
definition, 169 
processors supported, 4 
product numbers, 4 
assistant 
See setup assistant 
automatic allocation, 36 


B 


background debug monitor, 169 
BDM port 
See debug port 
BKG light, 143 
BNC 
break in, 88 
trigger out, 87 
BNC, LAN, 132 
BOOTP request, 35, 36 
Break In SMB, 88 
Break In SMB port, 132 
built-in commands 
configuration, 74 
LAN configuration, 34 
list of commands, 145 


C 


cable 
emulation probe, 67 
module/probe interconnect, 47 
point-to-point LAN, 29 
power, 20 
serial, 32 

CD-ROM, installing software from, 

52 

cf commands, 74 

cleaning, 168 

cleaning the instrument, 181 


clocks 

specifications, 132 

TCK speed, 94 
configuration, 71 

emulation module, 71, 72, 76 
configuration files 

installing, 49 
configure, 87 
connection 

emulation module, 65 

host workstation, 27 

power, 20 

problems, LAN, 156 

problems, RS-232, 159 

sequence, 21 
connector 

1OBASE2, 132 

1OBASE-T, 27, 132 

JTAG, 59 

JTAG, designing, 56 

JTAG, levels, 150 
connector board 

definition, 169 
cross-talk, 56 


D 


data communications 
specifications, 132 
debug mode, 169 
debug port, 169 
connecting to, 56, 67 
debuggers, 105 
configuration, 76 
development port 
See debug port 
DHCP, 35 


disconnecting the emulation probe, 


91 
driver firmware error, 151 
dynamic allocation, 36 


E 


E8130A product number, 164 
elastomeric probe adapter 
definition, 169 
electrical characteristics, 131 
emulation control connector, 56 
Emulation Control Interface 
configuration, 73 
emulation migration 
See migration 
emulation module 
configuration, 76 
connecting, 65, 67 
connecting to probe, 47 
definition, 169 
description of, 3 
installing, 43 
product numbers, 4 
using debugger, 76 
emulation probe 
definition, 169 
problems, solving, 162 
emulation solution 
See solution 
equipment required 
emulation module, 22 
equipment supplied 
emulation migration, 24 
emulation module, 22 
ordering information, 4 
overview, 4 
ethernet address, 34 
See link-level address 
extender, 169 


F 


files 

loading vs. installing, 50 
firmware 

version, 119, 120 
flexible adapter 

definition, 170 
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flowchart, setup, 17 


G 


gateway address, 34, 156 
definition, 170 

general-purpose flexible adapter 
definition, 170 


H 


hardware address 
See link-level address 
high-density adapter cable 
definition, 170 
high-density termination adapter 
definition, 170 
host computer 
connecting to, 27 
HyperTerminal (MS Windows 
program), 159 


I 


IEEE 802.3, 27 

information sources, 26 

init command, 151 

installation, software, 49 

instrument, cleaning the, 181 

interconnect cable 
See cable, 

interconnect 

internet address, 31 

inverse assembler 
definition, 170 

IP address, 31, 34, 36, 156 
debugger connection, 107 
definition, 170 


module/probe 


J 


JTAG 
designing connector, 56 
jumper, definition, 170 


L 


labels 
definition, 170 
lan command, 34 
LAN connection problems, 156 
LAN interface, 27 
LAN parameters, 36 
debugger, 107 
setting with DHCP, 35 
setting with emulation module, 
37 
setting with serial connection, 34 
verifying, 35 
ways to set, 28 
LEDs, 143 
lights 
See status lights 
link-level address, 36 
definition, 171 
displaying, 34 
location of, 35 
loading configurations 
vs. installing, 49 


M 


MAC address 
See link-level address 
mainframe logic analyzer 
definition, 171 
male-to-male header 
definition, 171 
manual allocation, 36 
mask, subnet, 157 
MAU, 132 
memory 
testing, 154 
microprocessors supported, 4 
migration 
installing, 123 
minimum equipment, 18 
module/probe interconnect cable, 
47 


monitor, 79 
Monitor Mode, 87 
monitor, background debug, 169 


N 


noise, 56 
noise, reducing, 59 


O 
overview, 71, 72 


P 


PC 

connecting to, 27 
performance verification tests, 

162, 163 

performance, improving, 94 
ping command, 40, 156 
pods, logic analyzer, 171 
point-to-point LAN connection, 38 
port number 

changing, 34 

debugger, 107 

default, 31 
power off procedure, 21 
power on procedure, 20 
POWER signal, 89 
power supply, 20 
preprocessor 

See analysis probe 
preprocessor interface 

See analysis probe 
processor family 

changing, 124 
processor support package, 52 
processors supported, 4 
product numbers, 164 
prompts 

list of, 147 

troubleshooting, 151 
prototype analyzer 

definition, 171 
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PV 
See performance verification 


R 


real-time runs, configuring, 78, 79 
references, 26 
register commands, 148 
repair 

emulation module, 166 
requirements, 18 
RESET 

configuring, 85 

light, 143 
Return Test Clock signal, 59 
RTCK signal, 59 
run control tool 

See emulation control interface 


S 


sequence, 21 
serial connection 
cable, 32 
DCE or DTE selection, 159 
number of connections, 159 
problems, 159 
verifying, 33 
service ports, 34 
service, how to obtain, 166 
setup 
See configuration 
Setup Assistant 
networking disabled, 39 
setup assistant, 121 
definition, 171 
setup flowchart, 17 
signals 
JTAG, 58 
signals, expected levels, 150 
slow clock message, 137 
SMB 
Break In configuration, 88 


software 
installing, 49 
list of installed, 53 
solution, 26 
at a glance, 2 
definition, 171 
description of, 2 
specifications 
altitude, 133 
clock, 132 
data communications, 132 
temperature, 133 
speed 
improving, 94 
standalone configuration 
See point-to-point connection 
state analysis, 171 
static allocation, 35, 36 
status lights, 143 
subnet mask, 34, 156, 157 
definition, 172 
switches 
LAN configuration, 34 
symbols 
definition, 172 


T 


target board adapter 
definition, 172 
target control port, 172 
target interface module (TIM) 
definition, 172 
target system 
connecting to, 65 
problems with, 148 
TCK signal, 94 
TCP, 34 
TDO, TDI signals, 59 
telnet, 40, 41, 145, 156 
temperature specifications, 133 


terminal interface, 41 

LAN parameters, setting, 34 
See also built-in commands 
tests, emulation module, 161 
ThinLAN, 28, 132 

timing analysis, 172 

trace length, 59 

transition board 

definition, 172 

trigger 

limitation, 88 

Trigger Out SMB port, 132 
troubleshooting, 137 


U 


Updating Firmware, 118 
USER light, 143 


Vv 


versions 
emulation module firmware, 120 
emulation probe firmware, 119 
voltage reference, configuring, 89 
voltage, emulation probe, 131 
Vref signal, 89 


WwW 


web interface, 108 
web sites 
Agilent logic analyzers, 26 
See Also under debugger names 
wizard 
See setup assistant 
workstation 
connecting to, 27 
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“£2 Agilent Technologies [)JECLARATION OF CONFORMITY 


According to ISO/IEC Guide 22 and CEN/EN 45014 


Manufacturer's Name: Agilent Technologies, Inc. / Digital Design PGU 


Manufacturer's Address: 1900 Garden of the Gods Road 
Colorado Springs, Colorado 80907 USA 


Declares, that the product 


Product Name: Emulation Probe 
Model Number(s): Agilent Technologies E5900B, E5902B 
Product Option(s): All options based on the above 


is in conformity with: 


EMC IEC 61326-1:1997+A1:1998 / EN 61326-1:1997+A1:1998 
CISPR 11:1990 / EN 55011:1991—Group 1 Class A!" 
IEC 61000-4-2:1995+A1:1998 / EN 61000-4-2:1995 (ESD 4kV CD, 8kV AD) 
IEC 61000-4-3:1995 / EN 61000-4-3:1995 (3 V/m 80% AM) 
IEC 61000-4-4:1995 / EN 61000-4-4:1995 (0.5kV line-line, 1kV line-earth) 


IEC 61000-4-6:1996 / EN 61000-4-6:1996 (3V 80% AM, power line) 
Australia/New Zealand: AS/NZS 2064.1 


Safety IEC 1010-1: 1990+A1:1992+A2:1995 / EN 61010-1: 1994+A2:1995 
Canada: CSA-C22.2 No. 1010.1:1992 
USA: UL 3111-1:1994 


Additional Information: 


The product herewith complies with the requirements of the Low Voltage Directive 73/23/EEC and the EMC Directive 
89/336/EEC (including 93/68/EEC) and carries the CE marking accordingly (European Union). 


(This product was tested in a typical configuration with Agilent Technologies test systems. 


Date: 12/30/99 Kel yatt 


Ken Wyatt / Product Regulations Manager 


For further information, please contact your local Agilent Technologies sales office, agent or distributor. 


Product Regulations 


EMC IEC 61326-1:1997+A1 71998 / EN 61326-1:1997+A1:1998 Performance Criteria 
CISPR 11:1990 / EN 55011:1991—Group 1 Class A 
IEC 61000-4-2:1995+A1:1998 / EN 61000-4-2:1995 (ESD 4kV CD, 8kV AD) 
IEC 61000-4-3:1995 / EN 61000-4-3:1995 (3 V/m 80% AM) 
IEC 61000-4-4:1995 / EN 61000-4-4:1995 (EFT 0.5kV line-line, 1kV line-earth) 
IEC 61000-4-6:1996 / EN 61000-4-6:1996 (3V 80% AM, power line) 
Australia/New Zealand: AS/NZS 2064.1 


rPrro 


Safety IEC 1010-1: 1990+A1:1992+A2:1995 / EN 61010-1: 1994+A2:1995 
Canada: CSA-C22.2 No. 1010.1:1992 
USA: UL 3111-1:1994 {optional} 


Additional Information: 


The product herewith complies with the requirements of the Low Voltage Directive 73/23/EEC and the EMC Directive 89/ 
336/EEC (including 93/68/EEC) and carries the CE marking accordingly (European Union). 


Performance Criteria: 

A Pass - Normal operation, no effect. 

B Pass - Temporary degradation, self recoverable. 

C Pass - Temporary degradation, operator intervention required. 
D Fail - Not recoverable, component damage. 


Note: 
Use standard ESD preventive practices while handling and connecting the E5900B to its target to avoid component 
damage. 


Sound N/A 
Pressure 
Level 
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According to ISO/IEC Guide 22 and CEN/EN 45014 


Manufacturer's Name: Agilent Technologies, Inc. / Digital Design PGU 


Manufacturer's Address: 1900 Garden of the Gods Road 
Colorado Springs, Colorado 80907 USA 


Declares, that the product 


Product Name: Emulation Module 
Model Number(s): Agilent Technologies E5901B 
Product Option(s): All options based on the above 


is in conformity with: 


EMC IEC 61326-1:1997+A1:1998 / EN 61326-1:1997+A1:1998 
CISPR 11:1990 / EN 55011:1991—Group 1 Class A!" 
IEC 61000-4-2:1995+A1:1998 / EN 61000-4-2:1995 (ESD 4kV CD, 8kV AD) 
IEC 61000-4-3:1995 / EN 61000-4-3:1995 (3 V/m 80% AM) 
IEC 61000-4-4:1995 / EN 61000-4-4:1995 (0.5kV line-line, 1kV line-earth) 


IEC 61000-4-6:1996 / EN 61000-4-6:1996 (3V 80% AM, power line) 
Australia/New Zealand: AS/NZS 2064.1 


Safety IEC 1010-1: 1990+A1:1992+A2:1995 / EN 61010-1: 1994+A2:1995 
Canada: CSA-C22.2 No. 1010.1:1992 
USA: UL 3111-1:1994 


Additional Information: 


The product herewith complies with the requirements of the Low Voltage Directive 73/23/EEC and the EMC Directive 
89/336/EEC (including 93/68/EEC) and carries the CE marking accordingly (European Union). 


(This product was tested in a typical configuration with Agilent Technologies test systems. 


Date: 12/30/99 Kel yatt 


Ken Wyatt / Product Regulations Manager 


For further information, please contact your local Agilent Technologies sales office, agent or distributor. 


Product Regulations 


EMC IEC 61326-1:1997+A1:1998 / EN 61326-1:1997+A1:1998 
CISPR 11:1990 / EN 55011:1991—Group 1 Class A 
IEC 61000-4-2:1995+A1:1998 / EN 61000-4-2:1995 (ESD 4kV CD, 8kV AD) 
IEC 61000-4-3:1995 / EN 61000-4-3:1995 (3 V/m 80% AM) 
IEC 61000-4-4:1995 / EN 61000-4-4:1995 (EFT 0.5kV line-line, 1kV line-earth) 
IEC 61000-4-6:1996 / EN 61000-4-6:1996 (3V 80% AM, power line) 
Australia/New Zealand: AS/NZS 2064.1 


Safety IEC 1010-1: 1990+A1:1992+A2:1995 / EN 61010-1: 1994+A2:1995 
Canada: CSA C22.2 No. 1010.1:1992 
USA: UL 3111-1:1994 {optional} 


Additional Information: 


Performance Criteria 


rrr, 


The product herewith complies with the requirements of the Low Voltage Directive 73/23/EEC and the EMC Directive 89/ 


336/EEC (including 93/68/EEC) and carries the CE marking accordingly (European Union). 


Performance Criteria: 

A Pass - Normal operation, no effect. 

B Pass - Temporary degradation, self recoverable. 

C Pass - Temporary degradation, operator intervention required. 
D Fail - Not recoverable, component damage. 


Sound N/A 
Pressure 
Level 


@ni0149 ce 


Safety 
Notices 


This apparatus has been 
designed and tested in accor- 
dance with IEC Publication 1010, 
Safety Requirements for Mea- 
suring Apparatus, and has been 
supplied in a safe condition. 
This is a Safety Class | instru- 
ment (provided with terminal for 
protective earthing). Before 
applying power, verify that the 
correct safety precautions are 
taken (see the following warn- 
ings). In addition, note the 
external markings on the instru- 
ment that are described under 
"Safety Symbols." 


Warnings 


¢ Before turning on the instru- 
ment, you must connect the pro- 
tective earth terminal of the 
instrument to the protective con- 
ductor of the (mains) power 
cord. The mains plug shall only 
be inserted in a socket outlet 
provided with a protective earth 
contact. You must not negate 
the protective action by using an 
extension cord (power cable) 
without a protective conductor 
(grounding). Grounding one 
conductor of a two-conductor 
outlet is not sufficient protec- 
tion. 


¢ Only fuses with the required 
rated current, voltage, and spec- 
ified type (normal blow, time 
delay, etc.) should be used. Do 
not use repaired fuses or short- 
circuited fuseholders. To do so 
could cause a shock or fire haz- 
ard. 


¢ If you energize this instrument 
by an auto transformer (for volt- 
age reduction or mains isola- 
tion), the common terminal must 
be connected to the earth termi- 
nal of the power source. 


¢ Whenever it is likely that the 


ground protection is impaired, 
you must make the instrument 
inoperative and secure it against 
any unintended operation. 


¢ Service instructions are for 
trained service personnel. To 
avoid dangerous electric shock, 
do not perform any service 
unless qualified to do so. Do not 
attempt internal service or 
adjustment unless another per- 
son, capable of rendering first 
aid and resuscitation, is present. 


¢ Do not install substitute parts 
or perform any unauthorized 
modification to the instrument. 


¢ Capacitors inside the instru- 
ment may retain a charge even if 
the instrument is disconnected 
from its source of supply. 


¢ Do not operate the instrument 
in the presence of flammable 
gasses or fumes. Operation of 
any electrical instrument in such 
an environment constitutes a 
definite safety hazard. 


¢ Do not use the instrument in a 
manner not specified by the 
manufacturer. 


To clean the instrument 


If the instrument requires clean- 
ing: (1) Remove power from the 
instrument. (2) Clean the exter- 
nal surfaces of the instrument 
with a soft cloth dampened with 
a mixture of mild detergent and 
water. (3) Make sure that the 
instrument is completely dry 
before reconnecting it to a 
power source. 


Safety Symbols 


AN 


Instruction manual symbol: the 
product is marked with this sym- 
bol when it is necessary for you 
to refer to the instruction man- 
ual in order to protect against 
damage to the product.. 


J 


Hazardous voltage symbol. 
I 
Earth terminal symbol: Used to 


indicate a circuit common con- 
nected to grounded chassis. 


Agilent Technologies Inc. 
P.O. Box 2197 
1900 Garden of the Gods Road 


Colorado Springs, CO 80901-2197, U.S.A. 


Notices 


© Agilent Technologies, Inc. 1994- 
2002 


No part of this manual may be 
reproduced in any form or by 
any means (including electronic 
storage and retrieval or transla- 
tion into a foreign language) 
without prior agreement and 
written consent from Agilent 
Technologies, Inc. as governed 
by United States and interna- 
tional copyright laws. 


Manual Part Number 
E3459-97010, April 2002 


Print History 


Print history is as follows: 
E3459-97009, September 2001 
E3459-97008, February 2001 
E3459-97007, October 2000 
E2459-97006, July 2000 
E3459-97003, May 2000 


Agilent Technologies, Inc. 
1900 Garden of the Gods Road 
Colorado Springs, CO 80907 USA 


Restricted Rights Legend 


If software is for use in the per- 
formance of a U.S. Government 
prime contract or subcontract, 
Software is delivered and 
licensed as “Commercial com- 
puter software” as defined in 
DFAR 252.227-7014 (June 1995), 
or as a “commercial item” as 
defined in FAR 2.101(a) or as 
“Restricted computer software” 
as defined in FAR 52.227-19 
(June 1987) or any equivalent 
agency regulation or contract 
clause. Use, duplication or dis- 
closure of Software is subject to 
Agilent Technologies’ standard 
commercial license terms, and 
non-DOD Departments and 
Agencies of the U.S. Govern- 
ment will receive no greater 
than Restricted Rights as 
defined in FAR 52.227-19(c)(1-2) 
(June 1987). U.S. Government 
users will receive no greater 


than Limited Rights as defined in 
FAR 52.227-14 (June 1987) or 
DFAR 252.227-7015 (b)(2) 
(November 1995), as applicable 
in any technical data. 


Document Warranty 


The material contained in 
this document is provided 
“as is,” and is subject to 
being changed, without 
notice, in future editions. 
Further, to the maximum 
extent permitted by applica- 
ble law, Agilent disclaims 
all warranties, either 
express or implied, with 
regard to this manual and 
any information contained 
herein, including but not 
limited to the implied war- 
ranties of merchantability 
and fitness for a particular 
purpose. Agilent shall not be 
liable for errors or for inci- 
dental or consequential 
damages in connection with 
the furnishing, use, or per- 
formance of this document 
or of any information con- 
tained herein. Should Agi- 
lent and the user have a 
separate written agreement 
with warranty terms cover- 
ing the material in this docu- 
ment that conflict with these 
terms, the warranty terms in 
the separate agreement 
shall control. 


Technology Licenses 


The hardware and/or software 
described in this document are 
furnished under a license and 
may be used or copied only in 
accordance with the terms of 
such license. 


WARNING 


A WARNING notice 
denotes a hazard. It calls 
attention to an operating 
procedure, practice, or 
the like that, if not 
correctly performed or 
adhered to, could result 
in personal injury or 
death. Do not proceed 
beyond a WARNING 
notice until the indicated 
conditions are fully 
understood and met. 


CAUTION 


A CAUTION notice 
denotes a hazard. It calls 
attention to an operating 
procedure, practice, or 
the like that, if not 
correctly performed or 
adhered to, could result in 
damage to the product or 
loss of important data. Do 
not proceed beyond a 
CAUTION notice until the 
indicated conditions are 
fully understood and met. 


Trademark Acknowledgements 
UNIX is a registered trademark 
of the Open Group. 


Windows and MS Windows are 
U.S. registered trademarks of 
Microsoft Corporation. 


Windows NT is a U.S. regis- 
tered trademark of Microsoft 
Corporation. 


ARM is a registered trademark 
of ARM Limited. 


ARM7TDM1 is a trademark of 
ARM Limited. 


